Lucene search

[email protected]NVD:CVE-2022-39072

HistoryJan 06, 2023 - 7:15 p.m.

CVE-2022-39072

2023-01-0619:15:09

CWE-89

[email protected]

web.nvd.nist.gov

cve-2022-39072

sql injection

zte mobile internet

sntp interface

stored xss attacks

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.0%

JSON

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.

Affected configurations

NVD

Node

ztemf286rMatch-

AND

ztemf286r_firmwareMatchnordic_mf286r_b06