Overview
- Description
- Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.
- Source
- psirt@zte.com.cn
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 3.5
- Impact score
- 1.4
- Exploitability score
- 2.1
- Vector string
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Severity
- LOW
CVSS 2.0
- Type
- Primary
- Base score
- 2.7
- Impact score
- 2.9
- Exploitability score
- 5.1
- Vector string
- AV:A/AC:L/Au:S/C:N/I:P/A:N
Weaknesses
- nvd@nist.gov
- CWE-20
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zte:zxhn_z500:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6733C2DF-7974-4552-8A32-381D4030629B"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zte:zxhn_z500_firmware:v1.0.0.2b1.1000:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFCCD8D8-9A70-4F84-A57B-AE615DEB5025"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zte:zxhn_f670l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0FA91D9C-2F8C-4567-887F-CD9C39045B5E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zte:zxhn_f670l_firmware:v1.1.10p1n2e:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01DC21FE-715F-4950-811E-376F5648315E"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]