PT-2020-19274 · F6X2W · F6X2W

Published 2020-01-17 · Updated 2022-04-26 · CVE-2020-6862

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions F6x2W product versions V6.0.10P2T2 through V6.0.10P2T5

Description The issue allows unauthorized users to log in directly and obtain page information without entering a verification code, due to an information leak. This can be exploited for privilege escalation.

Recommendations For versions V6.0.10P2T2 through V6.0.10P2T5, consider implementing additional verification measures to prevent unauthorized access until a patch is available. As a temporary workaround, restrict access to sensitive page information to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2020-6862

Affected Products

F6X2W

References · 6

• 🔥 http://packetstormsecurity.com/files/159135/ZTE-F602W-CAPTCHA-Bypass.html · Exploit
• 🔥 https://exploit-db.com/exploits/48801 · Exploit
• https://osv.dev/vulnerability/CVE-2020-6862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6862 · Security Note
• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012162 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/1729 · Telegram Post