CVEvulnerability

CVE-2023-25651

8.0 HIGH Published 2023-12-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-89

Description

There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.

Affected configurations

• zte mf833u1 firmware bd mf833u1v1.0.0b01 • zte mf286r firmware cr lvwrgbmf286rv1.0.0b04

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References