PT-2020-19277 · Zte · Zte Sdn Controller Platform

Published 2020-04-30 · Updated 2020-05-05 · CVE-2020-6865

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZTE SDN controller platform versions V16.19.10 through V16.19.20

Description The ZTE SDN controller platform is impacted by an information leakage issue. Due to the program's failure to optimize the response to a request failure, the caller can directly view the internal error code location of the component. Attackers could exploit this to obtain sensitive information.

Recommendations For versions V16.19.10 and V16.19.20, consider restricting access to the component until a patch is available. As a temporary workaround, avoid using the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-6865

Affected Products

Zte Sdn Controller Platform

References · 4

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012782 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6865 · Security Note
• https://t.me/cvenotify/3479 · Telegram Post