CVE-2020-6871

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-20 · updated 2026-06-17
Weakness: CWE-287

Description

The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. This affects: <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>

Affected products

ZTE R5300G4 Firmware: 03.04.0020, 03.05.0040, 03.05.0043, 03.05.0044, 03.05.0045, 03.05.0046 (+6)
ZTE R5500G4 Firmware: 03.06.0100, 03.07.0100, 03.07.0200, 03.08.0100
ZTE R8500G4 Firmware: 03.05.0020, 03.05.0400, 03.06.0100, 03.07.0101, 03.07.0103

References

Get alerted when CVE-2020-6871 or the next vulnerability affects your stack