There is a command injection vulnerability in some ZTE... · CVE-2023-25643 · GitHub Advisory Database · GitHub

There is a command injection vulnerability in some ZTE...

High severity Unreviewed Published Dec 14, 2023 to the GitHub Advisory Database • Updated Dec 14, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.

References

Published by the National Vulnerability Database

Dec 14, 2023

Published to the GitHub Advisory Database Dec 14, 2023

Last updated Dec 14, 2023

Severity

High

8.5

/ 10

CVSS base metrics

Attack vector

Adjacent

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H