CVE-2023-25651: SQL Injection Vulnerability in Some ZTE Mobile Internet Products
Published Dec 14, 2023
·Updated
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.
Affected Software
4 affected components
All of the following
ZTE Mf833u1 Firmware=bd_mf833u1v1.0.0b01
ZTE Mf833u1
All of the following
ZTE Mf286r Firmware=cr_lvwrgbmf286rv1.0.0b04
ZTE MF286R
Remediation
Information
BD_MF833U1V1.0.0B02,
CR_LVWRGBMF286RV1.0.1B01
Event History
Dec 14, 2023
CVE Published
07:03 AM
Data Sourced
07:03 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-25651?
CVE-2023-25651 is classified as a high severity SQL injection vulnerability.
2
How do I fix CVE-2023-25651?
To fix CVE-2023-25651, ensure the affected ZTE firmware is updated to a patched version.
3
What types of devices are affected by CVE-2023-25651?
CVE-2023-25651 affects specific ZTE mobile internet products, particularly the MF833U and MF286R models.
4
What could happen if CVE-2023-25651 is exploited?
If exploited, CVE-2023-25651 could allow an authenticated attacker to perform SQL injection and leak sensitive information.
5
Is authentication required to exploit CVE-2023-25651?
Yes, an authenticated attacker is required to exploit the vulnerability in CVE-2023-25651.