CVE-2019-3427 Code injection in ZXCDN IAMWEB
An attacker can inject malicious code into the ZTE ZXCDN IAMWEB management page, leading to user information leakage and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3427?
CVE-2019-3427 is a high-severity code injection vulnerability in ZTE ZXCDN IAMWEB, published on 22 Nov 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malicious code into the management page, resulting in users’ information leakage.
Weakness: CWE-94
Which versions are affected by CVE-2019-3427?
It affects 1 product.
Products include Zte Zxcdn Iamweb Firmware.
How do I fix CVE-2019-3427?
No fix has been published for CVE-2019-3427 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-3427 being exploited?
There is no known exploitation of CVE-2019-3427 in the wild and no public exploit code.
Other vulnerabilities in ZTE ZXCDN IAMWEB
Sources
Also known as GHSA-j69f-j84r-85qg.