CVE-2020-6881 Denial of service in <ZXHN E8810, ZXHN E8820, ZXHN E8822>
Remote attackers can cause denial of service on ZTE routers by sending malformed MQTT messages due to insufficient input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6881?
CVE-2020-6881 is a high-severity denial of service vulnerability in <ZXHN E8810, ZXHN E8820, ZXHN E8822>, published on 21 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device, which will cause the device to deny service. This affects:<ZXHN E8810, ZXHN E8820, ZXHN E8822><E8810 V1.0.26, E8810 V2.0.1, E8820 V1.1.3L, E8820 V2.0.13, E8822 V2.0.13>
Weakness: CWE-346
Which versions are affected by CVE-2020-6881?
It affects 3 products.
Products include Zte Zxhn E8810 Firmware, Zte Zxhn E8820 Firmware, Zte Zxhn E8822 Firmware.
How do I fix CVE-2020-6881?
No fix has been published for CVE-2020-6881 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-6881 being exploited?
There is no known exploitation of CVE-2020-6881 in the wild and no public exploit code.
Other vulnerabilities in <ZXHN E8810, ZXHN E8820, ZXHN E8822>
Sources
Also known as GHSA-f6c6-g5xq-fvm6.