Details of VAR-202301-0493

ID

VAR-202301-0493

CVE

CVE-2022-39072

TITLE

ZTE MF286R firmware and MF289D Cross-site scripting vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2022-004831

DESCRIPTION

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks. ZTE MF286R firmware and MF289D Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with

Trust: 1.71

sources: NVD: CVE-2022-39072 // JVNDB: JVNDB-2022-004831 // VULMON: CVE-2022-39072

AFFECTED PRODUCTS

vendor:	zte	model:	mf286r	scope:	eq	version:	nordic_mf286r_b06	Trust: 1.0
vendor:	zte	model:	mf289d	scope:	eq	version:	cr_tmoczmf289dv1.0.0b07	Trust: 1.0
vendor:	zte	model:	mf286r	scope:	-	version:	-	Trust: 0.8
vendor:	zte	model:	mf289d	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-004831 // NVD: CVE-2022-39072

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-39072
value:	MEDIUM
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2022-39072
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2022-39072
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202301-485
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2022-39072
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 2.0
NVD:	CVE-2022-39072
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-004831 // CNNVD: CNNVD-202301-485 // NVD: CVE-2022-39072 // NVD: CVE-2022-39072

PROBLEMTYPE DATA

problemtype:	CWE-89	Trust: 1.0
problemtype:	Cross-site scripting (CWE-79) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-004831 // NVD: CVE-2022-39072

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202301-485

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202301-485

PATCH

title:	SQL Injection Vulnerability in Some ZTE Mobile Internet products	url:	https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028624	Trust: 0.8
title:	ZTE MF286R and MF289D Fixes for cross-site scripting vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=221347	Trust: 0.6

sources: JVNDB: JVNDB-2022-004831 // CNNVD: CNNVD-202301-485

EXTERNAL IDS

db:	NVD	id:	CVE-2022-39072	Trust: 3.3
db:	ZTE	id:	1028624	Trust: 1.7
db:	JVNDB	id:	JVNDB-2022-004831	Trust: 0.8
db:	CNNVD	id:	CNNVD-202301-485	Trust: 0.6
db:	VULMON	id:	CVE-2022-39072	Trust: 0.1

sources: VULMON: CVE-2022-39072 // JVNDB: JVNDB-2022-004831 // CNNVD: CNNVD-202301-485 // NVD: CVE-2022-39072

REFERENCES

url:	https://support.zte.com.cn/support/news/loopholeinfodetail.aspx?newsid=1028624	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2022-39072	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-39072/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2022-39072 // JVNDB: JVNDB-2022-004831 // CNNVD: CNNVD-202301-485 // NVD: CVE-2022-39072

SOURCES

db:	VULMON	id:	CVE-2022-39072
db:	JVNDB	id:	JVNDB-2022-004831
db:	CNNVD	id:	CNNVD-202301-485
db:	NVD	id:	CVE-2022-39072

LAST UPDATE DATE

2025-04-10T23:21:14.769000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2022-39072	date:	2023-01-08T00:00:00
db:	JVNDB	id:	JVNDB-2022-004831	date:	2023-05-09T02:10:00
db:	CNNVD	id:	CNNVD-202301-485	date:	2023-01-13T00:00:00
db:	NVD	id:	CVE-2022-39072	date:	2025-04-10T14:15:22.590

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2022-39072	date:	2023-01-06T00:00:00
db:	JVNDB	id:	JVNDB-2022-004831	date:	2023-05-09T00:00:00
db:	CNNVD	id:	CNNVD-202301-485	date:	2023-01-06T00:00:00
db:	NVD	id:	CVE-2022-39072	date:	2023-01-06T19:15:09.170