CVE-2022-39066

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 26.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-22 · updated 2026-06-17
Weakness: CWE-89

Description

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.

Affected products

MF286R: before mf286r_b07 — fixed in mf286r_b07

How to fix

Upgrade to a fixed version: MF286R mf286r_b07. Check the vendor advisory for mitigations.

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027744
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027744

Get alerted when CVE-2022-39066 or the next vulnerability affects your stack