CVE-2023-25644

2023-12-1408:15:38

CWE-755

[email protected]

web.nvd.nist.gov

cve-2023-25644

zte

denial of service

vulnerability

internet products

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0005 Low

EPSS

Percentile

17.0%

JSON

There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, an attacker could use the vulnerability to perform a denial of service attack.

Affected configurations

NVD

Node

ztemc801aMatch-

AND

ztemc801a_firmwareMatchmc801a_elisa3_b19

Node

ztemc801a1Match-

AND

ztemc801a1_firmwareMatchmc801a1_elisa1_b04

CPENameOperatorVersion
zte:mc801a_firmwarezte mc801a firmwareeqmc801a_elisa3_b19

CPE	Name	Operator	Version
zte:mc801a_firmware	zte mc801a firmware	eq	mc801a_elisa3_b19

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "MC801A",
    "vendor": "ZTE",
    "versions": [
      {
        "lessThanOrEqual": "B19",
        "status": "affected",
        "version": "MC801A_Elisa3_B19",
        "versionType": "B19"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "MC801A1",
    "vendor": "ZTE",
    "versions": [
      {
        "lessThanOrEqual": "B04",
        "status": "affected",
        "version": "MC801A1_Elisa1_B04",
        "versionType": "B04"
      }
    ]
  }
]