CVE-2024-22065CWE-20

ZTE MF258 Pro product has a OS Command injection vulnerability

Medium · published October 29, 2024

CVSS v3.1
6.8
EPSS
1%
Percentile
67.7
In the wild
Unconfirmed
What it is

There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01191 · 67.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-10-29T01:58Z
EPSS history
Timeline
  • 29 OCT 01:58Z
    ZTE MF258 Pro product has a OS Command injection vulnerability
    cvelistv5