Vulnerability · Published Dec 14, 2023 · Assigned by zte
CVE-2023-25643Two Vulnerabilities in Some ZTE Mobile Internet Products
High 8.4
In plain English
A high-severity command injection in MC801A from ZTE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)1.8%top 21.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H