High severity · published Dec 14, 2023
CVE-2023-25651
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use…
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mf286r Firmware · Zte
cr_lvwrgbmf286rv1.0.0b04 · source: NVD
MF
Mf833u1 Firmware · Zte
bd_mf833u1v1.0.0b01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25651
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25651
Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032684
More from Mf286r Firmware
9.8
CVE-2022-39073
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary…
8.8
CVE-2023-25649
There is a command injection vulnerability in a mobile internet product of ZTE
8.8
CVE-2022-39066
There is a SQL injection vulnerability in ZTE MF286R
6.5
CVE-2022-39067
There is a buffer overflow vulnerability in ZTE MF286R
5.4
CVE-2022-39072
There is a SQL injection vulnerability in Some ZTE Mobile Internet products