CVE-2022-39066

CVSS 8.8 HIGHEPSS 26.5%CWE-89

Vexday Risk Score

26Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 26.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

22 Nov 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · MF286R

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027744