What’s Vulnerable › Vulnerabilities

CVE-2023-25643: Two Vulnerabilities in Some ZTE Mobile Internet Products

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-14 · updated 2026-06-17
• Weakness: CWE-77

Description

There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Affected products

• ZTE Mc801A1 Firmware: mc801a1_elisa1_b04
• ZTE Mc801A Firmware: mc801a_elisa3_b19

References

• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032504
• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032504

Get alerted when CVE-2023-25643 or the next vulnerability affects your stack