VulnerabilityModified

CVE-2022-23144

There is a broken access control vulnerability in ZTE ZXvSTB product.

CRITICAL 9.1EPSS 0.71%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS: 0.71% probability · 52th percentile
CISA KEV: Not listed
Affected: zte/zxa10 b76hv3 firmware · zte/zxa10 b766v2 firmware · zte/zxa10 b800v2 firmware · zte/zxa10 b860av2.1 firmware · zte/zxa10 b860h firmware · zte/zxa10 b866v2-h firmware · zte/zxa10 b866v5-w10 firmware · zte/zxa10 b960gv1 firmware · zte/zxa10 b710c-a12 firmware · zte/zxa10 b710s2-a19 firmware · zte/zxa10 b836ct-a15 firmware · zte/zxa10 s100v firmware · zte/zxa10 s200a firmware · zte/zxa10 s200t firmware · zte/zxa10 b700v7 firmware
Source: psirt@zte.com.cn

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026224Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026224Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.