medium6.8
CVE-2023-25649
There is a command injection vulnerability in a mobile internet product of ZTE.
Impact
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zte | Mf286r Firmware | Version cr_lvwrgbmf286rv1.0.0b04 |