CVE-2022-23143

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-05 · updated 2026-06-17
Weakness: CWE-732

Description

ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use this vulnerability to maliciously delete and modify files.

Affected products

OTCP: before 2.21.40.06 — fixed in 2.21.40.06

How to fix

Upgrade to a fixed version: OTCP 2.21.40.06. Check the vendor advisory for mitigations.

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026164
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026164

Get alerted when CVE-2022-23143 or the next vulnerability affects your stack