VulnerabilityModified

CVE-2023-25643

There is a command injection vulnerability in some ZTE mobile internet products.

HIGH 8.8EPSS 1.77%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.77% probability · 77th percentile
CISA KEV: Not listed
Weakness: CWE-77
Affected: zte/mc801a firmware · zte/mc801a1 firmware
Source: psirt@zte.com.cn

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032504Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032504Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.