ZTE MF258 Pro Command Injection Vulnerability
CVE-2024-22065

8.8HIGH

Key Information:

Vendor

Zte

Status
Mf258 Pro
Vendor
CVE Published:
29 October 2024

What is CVE-2024-22065?

A command injection vulnerability exists in the ZTE MF258 Pro due to insufficient validation of input parameters in the Ping Diagnosis interface. An authenticated attacker can exploit this vulnerability to execute arbitrary commands on the device, potentially compromising its integrity and security. Proper input validation measures should be implemented to mitigate this risk.

Affected Version(s)

MF258 Pro 32 bit ZTE_MF258PRO_STD_V1.0.0B03

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bullet...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-22065 : ZTE MF258 Pro Command Injection Vulnerability