Medium severity · published Jan 6, 2023
CVE-2022-39072
There is a SQL injection vulnerability in Some ZTE Mobile Internet products
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mf286r Firmware · Zte
nordic_mf286r_b06 · source: NVD
MF
Mf289d Firmware · Zte
cr_tmoczmf289dv1.0.0b07 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39072
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39072
Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028624
More from Mf286r Firmware
9.8
CVE-2022-39073
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary…
8.8
CVE-2023-25649
There is a command injection vulnerability in a mobile internet product of ZTE
8.8
CVE-2022-39066
There is a SQL injection vulnerability in ZTE MF286R
8.0
CVE-2023-25651
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use…
6.5
CVE-2022-39067
There is a buffer overflow vulnerability in ZTE MF286R