CVE-2023-25649
OS Command Injection Vulnerability in a Mobile Internet Product of ZTE
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
OS Command Injection Vulnerability in a Mobile Internet Product of ZTE
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.
Reserved 2023-02-09 | Published 2023-08-25 | Updated 2024-10-02 | Assigner zteCWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
support.zte.com.cn/...LoopholeInfoDetail.aspx?newsId=1032544
Support options
