PT-2023-20211 · Unknown · Zxcloud Irai

Published 2023-12-14 · Updated 2023-12-19 · CVE-2023-25650

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZXCLOUD iRAI (affected versions not specified)

Description There is an issue where an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads. This is due to the backend not escaping special strings or restricting paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-25650

Affected Products

Zxcloud Irai

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-25650 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25650 · Vendor Advisory
• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032904 · Vendor Advisory
• https://t.me/cvenotify/63636 · Telegram Post
• https://t.me/cvenotify/64226 · Telegram Post
• https://twitter.com/CVEnew/status/1735196558025453767 · Twitter Post