CVE-2023-25643

2023-12-1408:15:38

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-25643

command injection

zte

mobile internet

products

input validation

network parameters

authenticated attacker

arbitrary commands

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

18.7%

JSON

There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Affected configurations

Nvd

Node

ztemc801a_firmwareMatchmc801a_elisa3_b19

AND

ztemc801aMatch-

Node

ztemc801a1_firmwareMatchmc801a1_elisa1_b04

AND

ztemc801a1Match-

VendorProductVersionCPE
ztemc801a_firmwaremc801a_elisa3_b19cpe:2.3:o:zte:mc801a_firmware:mc801a_elisa3_b19:*:*:*:*:*:*:*
ztemc801a-cpe:2.3:h:zte:mc801a:-:*:*:*:*:*:*:*
ztemc801a1_firmwaremc801a1_elisa1_b04cpe:2.3:o:zte:mc801a1_firmware:mc801a1_elisa1_b04:*:*:*:*:*:*:*
ztemc801a1-cpe:2.3:h:zte:mc801a1:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zte	mc801a_firmware	mc801a_elisa3_b19	cpe:2.3:o:zte:mc801a_firmware:mc801a_elisa3_b19:::::::*
zte	mc801a	-	cpe:2.3:h:zte:mc801a:-:::::::*
zte	mc801a1_firmware	mc801a1_elisa1_b04	cpe:2.3:o:zte:mc801a1_firmware:mc801a1_elisa1_b04:::::::*
zte	mc801a1	-	cpe:2.3:h:zte:mc801a1:-:::::::*