Low severity · published Nov 19, 2020
CVE-2020-6879
Some ZTE devices have input verification vulnerabilities
3.5
CVSS
0.7%
EPSS
No
On KEV
Description
Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZF
ZXHN F670L ·
Affects: V1.1.10P1N2E; Fixed: V1.1.10P2N2 · source: vendor
ZZ
ZXHN Z500 ·
Affects: V1.0.0.2B1.1000; Fixed: V1.0.1.1B1.1000 · source: vendor
ZF
Zxhn F670l Firmware · Zte
v1.1.10p1n2e · source: NVD
ZZ
Zxhn Z500 Firmware · Zte
v1.0.0.2b1.1000 · source: NVD