CVE-2020-6872
Estado: ModificadaMedia (6.1)—
The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 6.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.74%
- Percentil entre todas las CVEs puntuadas: 53
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-6872",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@zte.com.cn",
"affectedData": [
{
"vendor": "n/a",
"product": "<R5300G4?R8500G4?R5500G4>",
"versions": [
{
"status": "affected",
"version": "<R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020"
},
{
"status": "affected",
"version": "R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020"
},
{
"status": "affected",
"version": "R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>"
}
]
}
]
}
],
"published": "2020-07-20T18:15:12.623",
"references": [
{
"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203",
"tags": [
"Vendor Advisory"
],
"source": "psirt@zte.com.cn"
},
{
"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>."
},
{
"lang": "es",
"value": "El módulo del software de administración del servidor de ZTE presenta una vulnerabilidad de tipo XSS almacenado. El atacante inserta algunos códigos de ataque por medio de la página de inicio de sesión en primer plano, lo que causará que un usuario ejecute un script malicioso predefinido en el navegador. Esto afecta a las versiones (R5300G4V03.08.0100/V03.07.0300/ V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/ V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.002043; R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/ V03.05.0020; R5500G4V03.08.0100/V03.07.0200/V03.07.0100/ V03.06.0100)"
}
],
"lastModified": "2026-06-17T03:23:57.417",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zte:r8500g4_firmware:03.05.0020:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "427C281A-23B9-4798-8EB1-97ABEBFBBB46"
},
{
"criteria": "cpe:2.3:o:zte:r8500g4_firmware:03.05.0400:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30294BA9-C5BC-4751-A64D-2AD69813322A"
},
{
"criteria": "cpe:2.3:o:zte:r8500g4_firmware:03.06.0100:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E7A7130-A881-4D40-9EC9-816384B75A71"
},
{
"criteria": "cpe:2.3:o:zte:r8500g4_firmware:03.07.0101:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE747C03-CBA0-4942-AF95-33F71200B353"
},
{
"criteria": "cpe:2.3:o:zte:r8500g4_firmware:03.07.0103:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7DD22DD-DA77-466D-B640-7910746795A7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zte:r8500g4:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "30671825-122A-4F27-A8BF-5CEBEFA96A35"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zte:r5500g4_firmware:03.06.0100:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF90E703-40FB-4A54-B67E-8E2E06E44D50"
},
{
"criteria": "cpe:2.3:o:zte:r5500g4_firmware:03.07.0100:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9034CF8E-BB91-4385-A044-9041DB0E9081"
},
{
"criteria": "cpe:2.3:o:zte:r5500g4_firmware:03.07.0200:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DF263BA-435F-44B1-8B64-F731D4812C1B"
},
{
"criteria": "cpe:2.3:o:zte:r5500g4_firmware:03.08.0100:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1C40CD1-FC7D-4146-83DE-EDF6A37B0BA3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zte:r5500g4:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6F8F83DC-A10F-4AEA-BA76-14F9F0EA9D44"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.04.0020:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBCDBC33-A6FB-4A88-BC07-E1DB4E6B6CF2"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.05.0040:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E238D3DB-5AF0-4A53-81B3-BABB7AFFDA41"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.05.0043:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B845BC7-608E-4583-9D32-3F28FA069D6D"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.05.0044:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06246428-5693-4CF2-BEFE-0DAD52005A61"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.05.0045:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F26029B1-BF93-4AEC-AC09-DCB77D423C2E"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.05.0046:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA7123C8-26E4-44CE-9780-197C1D054236"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.05.0047:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0071FD6-B5A4-4959-A195-BE246DF0E28F"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.07.0100:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D88DD18D-681D-4854-BD32-67EF17DD47DE"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.07.0108:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B3EB4B6-9649-4988-9FB8-3AF5BB4A4B0A"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.07.0200:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10446912-96D3-461E-8151-52C37EEA0863"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.07.0300:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C07D7CC-E7FD-480C-B8C3-580BD8CBCA0C"
},
{
"criteria": "cpe:2.3:o:zte:r5300g4_firmware:03.08.0100:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32427DC0-A743-44A9-B001-CE7243F0F92F"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zte:r5300g4:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A56E434E-DFE6-4CCC-A2EA-EBC25DA5F6D0"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@zte.com.cn"
}