CVE-2023-25649
OS Command Injection Vulnerability in a Mobile Internet Product of ZTE
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
OS Command Injection Vulnerability in a Mobile Internet Product of ZTE
| Assigner | zte |
| Reserved | 2023-02-09 |
| Published | 2023-08-25 |
| Updated | 2024-10-02 |
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.
| CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544
