Log in Start free

Vulnerability · Published Nov 19, 2020 · Assigned by zte

CVE-2020-6879

Low 3.5

In plain English

A low-severity security flaw in ZXHN F670L. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS NVD)3.5Low
Exploit odds (30 days)0.7%top 47.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.

Affected products (as reported)

VendorProductVersions
n/a ZXHN Z500 Affects: V1.0.0.2B1.1000Fixed: V1.0.1.1B1.1000
n/a ZXHN F670L Affects: V1.1.10P1N2EFixed: V1.1.10P2N2

References