title: Two Vulnerabilities in Some ZTE Mobile Internet Products
description:
There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an authenticated attacker could use the vulnerability to perform a denial of service attack.
problem types: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
affected:
{
defaultStatus: unaffected
platforms: Linux
product: MC801A
vendor: ZTE
versions:
lessThanOrEqual: B19, status: affected, version: MC801A_Elisa3_B19, versionType: B19
}
{
defaultStatus: unaffected
product: MC801A1
vendor: ZTE
versions:
lessThanOrEqual: B04, status: affected, version: MC801A1_Elisa1_B04, versionType: B04
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
MC801A_Elisa3_B22,
MC801A1_Elisa1_B06