CVE-2020-6880

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-01 · updated 2026-06-17
Weakness: CWE-89

Description

A ZXELINK wireless controller has a SQL injection vulnerability. A remote attacker does not need to log in. By sending malicious SQL statements, because the device does not properly filter parameters, successful use can obtain management rights. This affects: ZXV10 W908 all versions before MIPS_A_1022IPV6R3T6P7Y20.

Affected products

ZXV10 W908: before mips_a_1022ipv6r3t6p7y20 — fixed in mips_a_1022ipv6r3t6p7y20

How to fix

Upgrade to a fixed version: ZXV10 W908 mips_a_1022ipv6r3t6p7y20. Check the vendor advisory for mitigations.

References

http://www.zxelink.com.cn/website/html/CommonContent.html?classify=news&id=43&menuID=20201126153313319
http://www.zxelink.com.cn/website/html/CommonContent.html?classify=news&id=43&menuID=20201126153313319

Get alerted when CVE-2020-6880 or the next vulnerability affects your stack