CVE-2023-25651: SQL Injection Vulnerability in Some ZTE Mobile Internet Products

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-14 · updated 2026-06-17
Weakness: CWE-20

Description

There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.

Affected products

MF286R: cr_lvwrgbmf286rv1.0.0b04
ZTE Mf833U1 Firmware: bd_mf833u1v1.0.0b01

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032684
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032684

Get alerted when CVE-2023-25651 or the next vulnerability affects your stack