CVE-2023-25649 OS Command Injection Vulnerability in a Mobile Internet Product of ZTE

What is CVE-2023-25649?

CVE-2023-25649 is a medium-severity command injection vulnerability in ZTE MF286R, published on 25 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Weakness: CWE-77

Which versions are affected by CVE-2023-25649?

It affects 1 product.

Products include Zte Mf286r Firmware.

How do I fix CVE-2023-25649?

No fix has been published for CVE-2023-25649 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-25649 being exploited?

There is no known exploitation of CVE-2023-25649 in the wild and no public exploit code.

Other vulnerabilities in ZTE MF286R

• CVE-2022-39073 Command injection in MF286R Critical 9.8
• CVE-2022-39066 SQL injection in MF286R High 8.8
• CVE-2022-39067 Memory corruption in MF286R Medium 6.5
• CVE-2022-39072 Cross-site scripting in MF286R,MF289D Medium 5.4
• CVE-2023-25651 SQL Injection Vulnerability in Some ZTE Mobile Internet Products Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g68x-2w79-87x5.