CVE-2020-6879: Input Validation
First published: Thu Nov 19 2020(Updated: )
Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.
Credit: psirt@zte.com.cn
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zte Zxhn Z500 Firmware | =v1.0.0.2b1.1000 | |
| Zte Zxhn Z500 | ||
| Zte Zxhn F670l Firmware | =v1.1.10p1n2e | |
| Zte Zxhn F670l |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
- collector/nvd-index
- agent/software-canonical-lookup
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/references
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/zte
- canonical/zte zxhn z500 firmware
- version/zte zxhn z500 firmware/v1.0.0.2b1.1000
- canonical/zte zxhn z500
- canonical/zte zxhn f670l firmware
- version/zte zxhn f670l firmware/v1.1.10p1n2e
- canonical/zte zxhn f670l