CVE-2020-6879

CVSS V2 Low 2.7 CVSS V3 Low 3.5
Description
Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.
Overview
  • CVE ID
  • CVE-2020-6879
  • Assigner
  • psirt@zte.com.cn
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2020-11-19T17:15:13
  • Last Modified Date
  • 2020-12-02T21:13:28
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:zte:zxhn_z500_firmware:v1.0.0.2b1.1000:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:zte:zxhn_z500:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:zte:zxhn_f670l_firmware:v1.1.10p1n2e:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:zte:zxhn_f670l:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:A/AC:L/Au:S/C:N/I:P/A:N
  • Access Vector
  • ADJACENT_NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 2.7
  • Severity
  • LOW
  • Exploitability Score
  • 5.1
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  • Attack Vector
  • ADJACENT_NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 3.5
  • Base Severity
  • LOW
  • Exploitability Score
  • 2.1
  • Impact Score
  • 1.4
References
Reference URL Reference Tags
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922 Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2020-6879
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6879
History
Created Old Value New Value Data Type Notes
2022-05-10 07:31:34 Added to TrackCVE
2022-12-05 17:05:46 2020-11-19T17:15Z 2020-11-19T17:15:13 CVE Published Date updated
2022-12-05 17:05:46 2020-12-02T21:13:28 CVE Modified Date updated
2022-12-05 17:05:46 Analyzed Vulnerability Status updated