PT-2019-16562 · Zte · Zte Wf820+

Published 2019-06-11 · Updated 2019-10-09 · CVE-2019-3410

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZTE WF820+ LTE Outdoor CPE product versions prior to UKBB WF820+ 1.0.0B06

Description The issue stems from the fact that web applications do not adequately verify whether requests come from trusted users, allowing an attacker to exploit this and send unexpected requests to the server through the affected client.

Recommendations For versions prior to UKBB WF820+ 1.0.0B06, update to UKBB WF820+ 1.0.0B06 or later to resolve the issue. As a temporary workaround, consider restricting access to the web application to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-3410

Affected Products

Zte Wf820+

References · 3

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010662 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3410 · Security Note