CVE-2020-6879

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.

CVSS v3 3.5 LOW
CVSS v2.0 2.7 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

2.7^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 5.1 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:zte:zxhn_z500_firmware:v1.0.0.2b1.1000:*:*:*:*:*:*:*

cpe:2.3:h:zte:zxhn_z500:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:zte:zxhn_f670l_firmware:v1.1.10p1n2e:*:*:*:*:*:*:*

cpe:2.3:h:zte:zxhn_f670l:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-11-19 17:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-6879

Mitre link : CVE-2020-6879

CVE.ORG link : CVE-2020-6879

JSON object : View

Products Affected

zte

zxhn_z500
zxhn_f670l
zxhn_z500_firmware
zxhn_f670l_firmware

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2020-6879", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 5.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2020-11-19T17:15:13.420", "references": [{"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922", "tags": ["Vendor Advisory"], "source": "psirt@zte.com.cn"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2."}, {"lang": "es", "value": "Algunos dispositivos ZTE presentan vulnerabilidades de comprobaci\u00f3n de entrada. Los dispositivos admiten la configuraci\u00f3n de un prefijo est\u00e1tico por medio de la p\u00e1gina de administraci\u00f3n web. La restricci\u00f3n del c\u00f3digo de front-end se puede omitir al construir un mensaje de petici\u00f3n POST y mediante el env\u00edo de la petici\u00f3n a la creaci\u00f3n de una interfaz de configuraci\u00f3n de reglas de enrutamiento est\u00e1tico. El backend del servicio WEB no puede verificar eficazmente la entrada anormal. Como resultado, el atacante puede usar con \u00e9xito la vulnerabilidad para alterar los valores de los par\u00e1metros. Esto afecta a: ZXHN Z500 V1.0.0.2B1.1000 y ZXHN F670L V1.1.10P1N2E. Esto se corrige en ZXHN Z500 V1.0.1.1B1.1000 y ZXHN F670L V1.1.10P2N2"}], "lastModified": "2020-12-02T21:13:28.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zte:zxhn_z500_firmware:v1.0.0.2b1.1000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFCCD8D8-9A70-4F84-A57B-AE615DEB5025"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zte:zxhn_z500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6733C2DF-7974-4552-8A32-381D4030629B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zte:zxhn_f670l_firmware:v1.1.10p1n2e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01DC21FE-715F-4950-811E-376F5648315E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zte:zxhn_f670l:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0FA91D9C-2F8C-4567-887F-CD9C39045B5E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@zte.com.cn"}