High severity · published Jun 11, 2019
CVE-2019-3411
All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WebUI login password without login, an attacker can exploit the vulnerability to obtain sensitive information about the affected components.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mf920 Firmware · Zte
before bd_r218v2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3411
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3411
Vendor Advisory
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010686
More from Mf920 Firmware
9.8
CVE-2019-3412
All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability