CVE-2023-25643: high-severity vulnerability in ZTE MC801A
Two Vulnerabilities in Some ZTE Mobile Internet Products
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
ZTE mobile internet products allow authenticated users to run unauthorized commands by injecting malicious input into network settings that aren't properly validated. This lets attackers take control of the device and perform harmful actions.
Command injection vulnerability in ZTE mobile internet products exploiting insufficient input validation of network parameters (CWE-77). Authenticated attacker can inject arbitrary commands through vulnerable parameters to achieve remote code execution on the affected device.
In the same product, most dangerous first.