CVE-2022-23143 Missing authorization in OTCP
An attacker with high permissions can maliciously delete and modify files due to improper permission settings in ZTE OTCP.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23143?
CVE-2022-23143 is a medium-severity missing authorization vulnerability in OTCP, published on 5 Dec 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use this vulnerability to maliciously delete and modify files.
Weakness: CWE-732
Which versions are affected by CVE-2022-23143?
It affects 1 product.
Products include Zte Otcp Firmware.
How do I fix CVE-2022-23143?
No fix has been published for CVE-2022-23143 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-23143 being exploited?
There is no known exploitation of CVE-2022-23143 in the wild and no public exploit code.
Other vulnerabilities in OTCP
Sources
Also known as GHSA-q769-j5f8-h8fv.