VulnerabilityModified

CVE-2022-23141

ZXMP M721 has an information leak vulnerability.

HIGH 7.5EPSS 0.76%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attacker could use this vulnerability to log in to the device to obtain sensitive information.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.76% probability · 53th percentile
CISA KEV: Not listed
Weakness: CWE-532
Affected: zte/zxmp m721 firmware
Source: psirt@zte.com.cn

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1025264Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1025264Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.