HIGH🇬🇧 English

CVE-2022-39066

CVSS 8.8v3.1pub. 2022-11-22upd. 2025-04-29

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Zte Mf286r

    HW
    Zte
    wszystkie wersje

  • Zte Mf286r Firmware

    OS
    Zte
    < mf286r_b07
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SQLi
CWE
Referencje

Powiązane podatności

CVE-2022-39073CRITICAL9.8PL ✓ten sam produkt

Command injection w ZTE MF286R — wykonanie dowolnych poleceń

CVE-2023-25651MEDIUM4.3ten sam produkt

There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input valida...

CVE-2023-25649MEDIUM6.8ten sam produkt

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validatio...

CVE-2022-39072MEDIUM5.4ten sam produkt

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of...

CVE-2022-39067MEDIUM6.5ten sam produkt

There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the w...