medium5.4
CVE-2022-39072
There is a SQL injection vulnerability in Some ZTE Mobile Internet products.
Impact
There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zte | Mf286r Firmware | Version nordic_mf286r_b06 |
| Zte | Mf289d Firmware | Version cr_tmoczmf289dv1.0.0b07 |