CVE-2022-39066

2022-11-2200:00:00

zte

www.cve.org

sql injection

zte mf286r

input validation

authenticated attacker

phonebook interface

arbitrary execution

EPSS

0.001

Percentile

37.0%

JSON

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "MF286R",
    "versions": [
      {
        "version": "Nordic_MF286R_B06",
        "status": "affected"
      }
    ]
  }
]

References

support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027744

EPSS

0.001

Percentile

37.0%

JSON

Related for CVELIST:CVE-2022-39066