CVE-2023-25650CWE-20

Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI

Medium · published December 14, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
47.4
In the wild
Unconfirmed
What it is

There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00589 · 47.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-12-14T06:52Z
EPSS history
Timeline
  • 14 DEC 06:52Z
    Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI
    cvelistv5