High severity · published Nov 22, 2022
CVE-2022-39066
There is a SQL injection vulnerability in ZTE MF286R
8.8
CVSS
26.5%
EPSS
No
On KEV
Description
There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)26.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mf286r Firmware · Zte
before mf286r_b07 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39066
Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027744
More from Mf286r Firmware
9.8
CVE-2022-39073
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary…
8.8
CVE-2023-25649
There is a command injection vulnerability in a mobile internet product of ZTE
8.0
CVE-2023-25651
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use…
6.5
CVE-2022-39067
There is a buffer overflow vulnerability in ZTE MF286R
5.4
CVE-2022-39072
There is a SQL injection vulnerability in Some ZTE Mobile Internet products