Lucene search

ZteCVE-2023-25644

HistoryDec 14, 2023 - 8:15 a.m.

CVE-2023-25644

2023-12-1408:15:38

CWE-755

zte

web.nvd.nist.gov

cve-2023-25644

zte

denial of service

vulnerability

internet products

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.0%

JSON

There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, an attacker could use the vulnerability to perform a denial of service attack.

Affected configurations

Nvd

Node

ztemc801aMatch-

AND

ztemc801a_firmwareMatchmc801a_elisa3_b19

Node

ztemc801a1Match-

AND

ztemc801a1_firmwareMatchmc801a1_elisa1_b04

VendorProductVersionCPE
ztemc801a-cpe:2.3:h:zte:mc801a:-:*:*:*:*:*:*:*
ztemc801a_firmwaremc801a_elisa3_b19cpe:2.3:o:zte:mc801a_firmware:mc801a_elisa3_b19:*:*:*:*:*:*:*
ztemc801a1-cpe:2.3:h:zte:mc801a1:-:*:*:*:*:*:*:*
ztemc801a1_firmwaremc801a1_elisa1_b04cpe:2.3:o:zte:mc801a1_firmware:mc801a1_elisa1_b04:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zte	mc801a	-	cpe:2.3:h:zte:mc801a:-:::::::*
zte	mc801a_firmware	mc801a_elisa3_b19	cpe:2.3:o:zte:mc801a_firmware:mc801a_elisa3_b19:::::::*
zte	mc801a1	-	cpe:2.3:h:zte:mc801a1:-:::::::*
zte	mc801a1_firmware	mc801a1_elisa1_b04	cpe:2.3:o:zte:mc801a1_firmware:mc801a1_elisa1_b04:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "MC801A",
    "vendor": "ZTE",
    "versions": [
      {
        "lessThanOrEqual": "B19",
        "status": "affected",
        "version": "MC801A_Elisa3_B19",
        "versionType": "B19"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "MC801A1",
    "vendor": "ZTE",
    "versions": [
      {
        "lessThanOrEqual": "B04",
        "status": "affected",
        "version": "MC801A1_Elisa1_B04",
        "versionType": "B04"
      }
    ]
  }
]

References

support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032624

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2023-25644