MEDIUM🇵🇱 Wersja polska

CVE-2022-39072

CVSS 5.4v3.1pub. 2023-01-06upd. 2025-04-10

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

  • Zte Mf286r

    HW
    Zte
    wszystkie wersje

  • Zte Mf286r Firmware

    OS
    Zte
    nordic_mf286r_b06

  • Zte Mf289d

    HW
    Zte
    wszystkie wersje

  • Zte Mf289d Firmware

    OS
    Zte
    cr_tmoczmf289dv1.0.0b07
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLiXSS
CWE
References

Related vulnerabilities

CVE-2022-39073CRITICAL9.8ten sam produkt

There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input paramete...

CVE-2022-39066HIGH8.8ten sam produkt

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters o...

CVE-2023-25651MEDIUM4.3ten sam produkt

There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input valida...

CVE-2023-25649MEDIUM6.8ten sam produkt

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validatio...

CVE-2022-39067MEDIUM6.5ten sam produkt

There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the w...