CVE Vulnerability

CVE-2020-6879

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.

2.7 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 5.1 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

3.5 /10

CVSS v3.0 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922 Vendor Advisory
Configurations

Configuration 1
Information

Published : 2020-11-19 05:15

Updated : 2020-12-02 09:13

NVD link : CVE-2020-6879

Mitre link : CVE-2020-6879

Products Affected
No products.
CWE
CWE-20