CVE-2023-25649 — OS Command Injection Vulnerability in a Mobile Internet Product of ZTE

CVE-2023-25649

OS Command Injection Vulnerability in a Mobile Internet Product of ZTE PUBLISHED

Description (CNA)

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Affected (CNA)

Vendor / product	Versions
ZTE / MF286R	affected CR_LVWRGBMF286RV1.0.0B04

CWE

CWE-77

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544

ADP enrichment

CVE

No English description supplied.

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544

CISA-ADP

No English description supplied.

No references supplied.