Mf286r Firmware vulnerabilities

4 known vulnerabilities in Mf286r Firmware from ZTE. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  Mobile Internet Products: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-25651Dec 14, 2023ZTE

  There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.

• 8.8 High severity

  MF286R: Improper Neutralization of Special Elements used in a Command

  CVE-2023-25649Aug 25, 2023ZTEEPSS 1.86%

  There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

• 9.8 Critical severity

  MF286R: Improper Neutralization of Special Elements used in a Command

  CVE-2022-39073Jan 6, 2023MF286REPSS 3.43%

  There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.

• 8.8 High severity

  MF286R: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-39066Nov 22, 2022MF286REPSS 26.5%

  There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.