CVE-2018-7355 Information

Description

All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection attacks on the devices.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483 https://www.exploit-db.com/exploits/46102/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1