title: Two Vulnerabilities in Some ZTE Mobile Internet Products
description:
There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.
problem types: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
affected:
{
defaultStatus: unaffected
platforms: Linux
product: MC801A
vendor: ZTE
versions:
lessThanOrEqual: B19, status: affected, version: MC801A_Elisa3_B19, versionType: B19
}
{
defaultStatus: unaffected
platforms: Linux
product: MC801A1
vendor: ZTE
versions:
lessThanOrEqual: B04, status: affected, version: MC801A1_Elisa1_B04, versionType: B04
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
MC801A_Elisa3_B22,
MC801A1_Elisa1_B06