VulnerabilityModified

CVE-2023-25651

There is a SQL injection vulnerability in some ZTE mobile internet products.

HIGH 8.0EPSS 0.34%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.

CVSS 3.1: 8.0 HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-20, CWE-89
Affected: zte/mf833u1 firmware · zte/mf286r firmware
Source: psirt@zte.com.cn

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032684Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032684Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.