PT-2019-16579 · Zte · Zxcdn Iamweb

Published 2019-11-22 · Updated 2020-08-24 · CVE-2019-3427

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZTE ZXCDN IAMWEB version V6.01.03.01

Description The issue allows an attacker to inject malicious code into the management page, potentially leading to users' information leakage. This is achieved through a code injection vulnerability.

Recommendations For version V6.01.03.01, consider restricting access to the management page until a fix is available to prevent potential code injection attacks.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-3427

Affected Products

Zxcdn Iamweb

References · 3

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011863 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3427 · Security Note