VulnerabilityModified

CVE-2022-39072

There is a SQL injection vulnerability in Some ZTE Mobile Internet products.

MEDIUM 5.4EPSS 0.34%

Does this matter?

Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.

Description

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: zte/mf286r firmware · zte/mf289d firmware
Source: psirt@zte.com.cn

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028624Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028624Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.