PT-2020-19289 · Zte · Zxhn Z500+1

Published 2020-11-19 · Updated 2020-12-03 · CVE-2020-6879

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZXHN Z500 versions 1.0.0.2B1.1000 through 1.0.0.2B1.1000 ZXHN F670L version 1.1.10P1N2E

Description Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the issue to tamper parameter values.

Recommendations For ZXHN Z500 version 1.0.0.2B1.1000, update to version 1.0.1.1B1.1000 to resolve the issue. For ZXHN F670L version 1.1.10P1N2E, update to version 1.1.10P2N2 to resolve the issue. As a temporary workaround, consider restricting access to the static routing rule configuration interface until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-6879

Affected Products

Zxhn F670

Zxhn Z500

References · 5

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6879 · Security Note
• https://t.me/cibsecurity/16609 · Telegram Post
• https://t.me/cvenotify/6482 · Telegram Post