Cross site scripting

The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects...

CVE-2020-6872

The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects...

CVE-2020-6872

The CVE-2020-6872 issue affects ZTE server-management software and is a storage XSS vulnerability. The attack path involves injecting malicious scripts via the foreground login page, causing the user’s browser to execute the payload. Affected firmware/models include multiple R5300G4V0x, R8500G4V0...

CVE-2020-6871

The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. This affects:...

CVE-2020-6871

CVE-2020-6871 concerns a ZTE server management software module with an authentication bypass that lets an attacker skip server authentication and execute commands with high-level privileges. The vulnerability affects multiple ZTE router/server models (e.g., R5300G4V03.x, R8500G4V03.x, R5500G4V03....

ZTE U31R20 Design Error Vulnerability

The ZTE U31R20 is a network management product from China's ZTE Corporation ZTE. A security vulnerability exists in ZTE U31R20 version V12.17.20T115. The vulnerability can be exploited by an attacker to log in to the FTP server to tamper with the password and illegally download, modify, upload or...

CVE-2020-6870

The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP server to tamper with the password, and illegally download, modify, upload, or delete files, causing improper operation of the network...

CVE-2020-6870

The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP server to tamper with the password, and illegally download, modify, upload, or delete files, causing improper operation of the network...

Input validation

The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP server to tamper with the password, and illegally download, modify, upload, or delete files, causing improper operation of the network...

CVE-2020-6870

The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP server to tamper with the password, and illegally download, modify, upload, or delete files, causing improper operation of the network...

CVE-2020-6870

CVE-2020-6870 concerns a design error in the ZTE U31R20 NetNumenU31R20 product, version V12.17.20T115. The vulnerability arises from an underlying design flaw that allows an attacker to log in to the FTP server, tamper with passwords, and illegally download, modify, upload, or delete files, poten...

ZTE F680 Input Validation Error Vulnerability

ZTE F680 is an external antenna dual-band GPON home gateway device from ZTE Corporation ZTE, China. A security vulnerability exists in the ZTE F680 version V9.0.10P1N6, which originates from incorrect access control. An attacker can exploit the vulnerability to tamper with program interface...

CVE-2020-6868

There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The front-end limits the length of the WAN connection name that is created, but the HTTP proxy is available to be used to bypass the limitation...

Input validation

There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The front-end limits the length of the WAN connection name that is created, but the HTTP proxy is available to be used to bypass the limitation...

CVE-2020-6868

The CVE-2020-6868 entry concerns a ZTE F680 PON gateway (V9.0.10P1N6) with an input validation flaw in the WAN-connection creation interface exposed via WEB management. The front-end enforces a length limit on the WAN connection name, but an HTTP proxy can bypass this limit, allowing an attacker ...

CVE-2020-6868

There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The front-end limits the length of the WAN connection name that is created, but the HTTP proxy is available to be used to bypass the limitation...

NewStart CGSL CORE 5.04 / MAIN 5.04 : ppp Vulnerability (NS-SA-2020-0027)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ppp packages installed that are affected by a vulnerability: - eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions. CVE-2020-8597 Note that Nessus has not...

NewStart CGSL CORE 5.04 / MAIN 5.04 : openjpeg2 Vulnerability (NS-SA-2020-0026)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openjpeg2 packages installed that are affected by a vulnerability: - opjt1clbldecodeprocessor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue th...

ZTE ZENIC ONE R22b Resource Management Error Vulnerability

ZTE ZENIC ONE R22b is a set of network SDN Software Defined Network intelligent management and control system from China's ZTE Corporation ZTE. The system includes functions such as network management, network control, network information collection and analysis. A resource management error...

CVE-2020-6867

ZTE's SDON controller is impacted by the resource management error vulnerability. When RPC is frequently called by other applications in the case of mass traffic data in the system, it will result in no response for a long time and memory overflow risk. This affects: ZENIC ONE R22b versions...