PT-2020-19291 · Zte · Zte E8820+2

Published 2020-12-21 · Updated 2020-12-22 · CVE-2020-6881

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ZTE E8810 version 1.0.26 ZTE E8810 version 2.0.1 ZTE E8820 version 1.1.3L ZTE E8820 version 2.0.13 ZTE E8822 version 2.0.13

Description The issue is caused by the failure of the device to verify the validity of abnormal messages, leading to a denial of service. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device, causing it to deny service.

Recommendations For ZTE E8810 version 1.0.26, update to a version that fixes the MQTT DoS vulnerability. For ZTE E8810 version 2.0.1, update to a version that fixes the MQTT DoS vulnerability. For ZTE E8820 version 1.1.3L, update to a version that fixes the MQTT DoS vulnerability. For ZTE E8820 version 2.0.13, update to a version that fixes the MQTT DoS vulnerability. For ZTE E8822 version 2.0.13, update to a version that fixes the MQTT DoS vulnerability. As a temporary workaround, consider restricting access to the MQTT server to minimize the risk of exploitation.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2020-6881

Affected Products

Zte E8810

Zte E8820

Zte E8822

References · 3

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6881 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6881 · Vendor Advisory