PT-2019-16566 · Zte · Zte Otcp

Published 2019-07-22 · Updated 2019-07-25 · CVE-2019-3414

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZTE OTCP product versions prior to V1.19.20.02

Description The issue allows an attacker to invoke security management and obtain resources of a specified operation code owned by a user. This is done by transmitting malicious script code in a parameter. If the front end does not process the returned result from the interface properly, the malicious script may be executed, potentially leading to the theft of user cookies or other important information.

Recommendations For versions prior to V1.19.20.02, update to version V1.19.20.02 or later to resolve the issue. As a temporary workaround, consider restricting access to the security management interface to minimize the risk of exploitation. Additionally, ensure that the front end properly processes returned results from the interface to prevent the execution of malicious scripts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-3414

Affected Products

Zte Otcp

References · 3

• https://osv.dev/vulnerability/CVE-2019-3414 · Vendor Advisory
• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3414 · Security Note