CVE-2023-25643CWE-77

Two Vulnerabilities in Some ZTE Mobile Internet Products

High · published December 14, 2023

CVSS v3.1
8.4
EPSS
2%
Percentile
78.0
In the wild
Unconfirmed
What it is

There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01772 · 78.0th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2023-12-14T07:19Z
EPSS history
Timeline
  • 14 DEC 07:19Z
    Two Vulnerabilities in Some ZTE Mobile Internet Products
    cvelistv5