MEDIUM🇵🇱 Wersja polska

CVE-2023-25651

CVSS 4.3v3.1pub. 2023-12-14upd. 2024-11-21

There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

  • Zte Mf286r

    HW
    Zte
    all versions

  • Zte Mf286r Firmware

    OS
    Zte
    cr_lvwrgbmf286rv1.0.0b04

  • Zte Mf833u1

    HW
    Zte
    all versions

  • Zte Mf833u1 Firmware

    OS
    Zte
    bd_mf833u1v1.0.0b01
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2022-39073CRITICAL9.8PL ✓same product

Command injection w ZTE MF286R — wykonanie dowolnych poleceń

CVE-2022-39066HIGH8.8same product

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters o...

CVE-2023-25649MEDIUM6.8same product

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validatio...

CVE-2022-39072MEDIUM5.4same product

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of...

CVE-2022-39067MEDIUM6.5same product

There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the w...