What’s Vulnerable › Vulnerabilities

CVE-2023-25649: OS Command Injection Vulnerability in a Mobile Internet Product of ZTE

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-25 · updated 2026-06-17
• Weakness: CWE-77

Description

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Affected products

• MF286R: cr_lvwrgbmf286rv1.0.0b04

References

• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544
• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544

Get alerted when CVE-2023-25649 or the next vulnerability affects your stack