CVE-2019-3417: high-severity vulnerability in ZTE ZXHN F670
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A command injection vulnerability in ZTE ZXHN F670 routers allows authorized users to execute arbitrary commands and take control of the device due to inadequate validation of user input parameters.
The vulnerability exists in parameter validation mechanisms of ZTE ZXHN F670 firmware versions up to V1.1.10P3T18, permitting authenticated attackers to inject arbitrary system commands through insufficiently sanitized input fields. Exploitation requires administrative access to the router's interface and results in complete system compromise.
In the same product, most dangerous first.