« Volver al listado

CVE-2020-6879

Estado: ModificadaBaja (3.5)—

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

ZTE — Zxhn F670l FirmwareZTE — Zxhn Z500 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6879",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.7,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 5.1,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@zte.com.cn",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "ZXHN Z500",
          "versions": [
            {
              "status": "affected",
              "version": "Affects: V1.0.0.2B1.1000"
            },
            {
              "status": "affected",
              "version": "Fixed: V1.0.1.1B1.1000"
            }
          ]
        },
        {
          "vendor": "n/a",
          "product": "ZXHN F670L",
          "versions": [
            {
              "status": "affected",
              "version": "Affects: V1.1.10P1N2E"
            },
            {
              "status": "affected",
              "version": "Fixed: V1.1.10P2N2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-19T17:15:13.420",
  "references": [
    {
      "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@zte.com.cn"
    },
    {
      "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2."
    },
    {
      "lang": "es",
      "value": "Algunos dispositivos ZTE presentan vulnerabilidades de comprobación de entrada. Los dispositivos admiten la configuración de un prefijo estático por medio de la página de administración web. La restricción del código de front-end se puede omitir al construir un mensaje de petición POST y mediante el envío de la petición a la creación de una interfaz de configuración de reglas de enrutamiento estático. El backend del servicio WEB no puede verificar eficazmente la entrada anormal. Como resultado, el atacante puede usar con éxito la vulnerabilidad para alterar los valores de los parámetros. Esto afecta a: ZXHN Z500 V1.0.0.2B1.1000 y ZXHN F670L V1.1.10P1N2E. Esto se corrige en ZXHN Z500 V1.0.1.1B1.1000 y ZXHN F670L V1.1.10P2N2"
    }
  ],
  "lastModified": "2026-06-17T03:23:58.037",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zte:zxhn_z500_firmware:v1.0.0.2b1.1000:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFCCD8D8-9A70-4F84-A57B-AE615DEB5025"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zte:zxhn_z500:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6733C2DF-7974-4552-8A32-381D4030629B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zte:zxhn_f670l_firmware:v1.1.10p1n2e:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01DC21FE-715F-4950-811E-376F5648315E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zte:zxhn_f670l:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0FA91D9C-2F8C-4567-887F-CD9C39045B5E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@zte.com.cn"
}