CVE-2023-25651: SQL Injection Vulnerability in Some ZTE Mobile Internet Products
First published: Thu Dec 14 2023(Updated: )
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.
Credit: psirt@zte.com.cn
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Zte Mf833u1 Firmware | =bd_mf833u1v1.0.0b01 | |
| Zte Mf833u1 | ||
| All of | ||
| Zte Mf286r Firmware | =cr_lvwrgbmf286rv1.0.0b04 | |
| ZTE MF286R |
Remedy
BD_MF833U1V1.0.0B02, CR_LVWRGBMF286RV1.0.1B01
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
- collector/nvd-api
- agent/severity
- agent/author
- agent/references
- agent/event
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/zte
- canonical/zte mf833u1 firmware
- version/zte mf833u1 firmware/bd_mf833u1v1.0.0b01
- canonical/zte mf833u1
- canonical/zte mf286r firmware
- version/zte mf286r firmware/cr_lvwrgbmf286rv1.0.0b04
- canonical/zte mf286r