ID
VAR-202308-3142
CVE
CVE-2023-25649
TITLE
ZTE of MF286R Command injection vulnerability in firmware
Trust: 0.8
DESCRIPTION
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands. ZTE of MF286R Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Authentication is required to exploit this vulnerability.The specific flaw exists within the handling of a request parameter provided to the SET_DEVICE_LED endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. ZTE MF286R is a wireless router made by China's ZTE Corporation. This vulnerability is caused by the application's failure to correctly filter special characters and commands in constructed commands
Trust: 2.88
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | zte | model: | mf286r | scope: | - | version: | - | Trust: 1.5 |
| vendor: | zte | model: | mf286r | scope: | eq | version: | cr_lvwrgbmf286rv1.0.0b04 | Trust: 1.0 |
| vendor: | zte | model: | mf286r | scope: | eq | version: | mf286r firmware cr lvwrgbmf286rv1.0.0b04 | Trust: 0.8 |
| vendor: | zte | model: | mf286r | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | zte | model: | mf286r cr lvwrgbmf286rv1.0.0b04 | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-77 | Trust: 1.0 |
| problemtype: | Command injection (CWE-77) [NVD evaluation ] | Trust: 0.8 |
PATCH
| title: | ZTE has issued an update to correct this vulnerability. | url: | https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544 | Trust: 0.7 |
| title: | Patch for ZTE MF286R command injection vulnerability (CNVD-2023-99925) | url: | https://www.cnvd.org.cn/patchInfo/show/508381 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2023-25649 | Trust: 4.0 |
| db: | ZTE | id: | 1032544 | Trust: 1.9 |
| db: | JVNDB | id: | JVNDB-2023-011463 | Trust: 0.8 |
| db: | ZDI_CAN | id: | ZDI-CAN-19059 | Trust: 0.7 |
| db: | ZDI | id: | ZDI-23-818 | Trust: 0.7 |
| db: | CNVD | id: | CNVD-2023-99925 | Trust: 0.6 |
| db: | VULMON | id: | CVE-2023-25649 | Trust: 0.1 |
REFERENCES
| url: | https://support.zte.com.cn/support/news/loopholeinfodetail.aspx?newsid=1032544 | Trust: 2.6 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2023-25649 | Trust: 1.4 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
CREDITS
Rafal Goryl (@voix44er)
Trust: 0.7
SOURCES
| db: | ZDI | id: | ZDI-23-818 |
| db: | CNVD | id: | CNVD-2023-99925 |
| db: | VULMON | id: | CVE-2023-25649 |
| db: | JVNDB | id: | JVNDB-2023-011463 |
| db: | NVD | id: | CVE-2023-25649 |
LAST UPDATE DATE
2024-08-14T13:52:14.873000+00:00
SOURCES UPDATE DATE
| db: | ZDI | id: | ZDI-23-818 | date: | 2023-08-31T00:00:00 |
| db: | CNVD | id: | CNVD-2023-99925 | date: | 2023-12-22T00:00:00 |
| db: | VULMON | id: | CVE-2023-25649 | date: | 2023-08-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-011463 | date: | 2023-12-13T06:24:00 |
| db: | NVD | id: | CVE-2023-25649 | date: | 2023-08-31T16:22:56.523 |
SOURCES RELEASE DATE
| db: | ZDI | id: | ZDI-23-818 | date: | 2023-06-07T00:00:00 |
| db: | CNVD | id: | CNVD-2023-99925 | date: | 2023-12-22T00:00:00 |
| db: | VULMON | id: | CVE-2023-25649 | date: | 2023-08-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-011463 | date: | 2023-12-13T00:00:00 |
| db: | NVD | id: | CVE-2023-25649 | date: | 2023-08-25T10:15:08.247 |