High severity · published Dec 14, 2023
CVE-2023-25643
Two Vulnerabilities in Some ZTE Mobile Internet Products
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MC801A · ZTE
MC801A_Elisa3_B19 through B19 · source: vendor, CISA
MC
MC801A1 · ZTE
MC801A1_Elisa1_B04 through B04 · source: vendor
MF
Mc801a Firmware · Zte
mc801a_elisa3_b19 · source: NVD
MF
Mc801a1 Firmware · Zte
mc801a1_elisa1_b04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25643
Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032504
More from MC801A
7.5
CVE-2023-25644
Denial of Service Vulnerability in Some ZTE Mobile Internet Products
6.5
CVE-2023-25642
Two Vulnerabilities in Some ZTE Mobile Internet Products