CVE-2022-23139 — HIGH (8.8)

Vulnerability Description

ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the actual permission. It’s easy for?users to?ignore the modification?of?the file permission configuration, so that low-authority accounts could actually obtain higher operating permissions on key files.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Zte	Zxmp M721 Firmware	5.10.030.006
Zte	Zxmp M721	-

Related Weaknesses (CWE)

CWE-863

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024444Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024444Vendor Advisory

FAQ

What is CVE-2022-23139?

CVE-2022-23139 is a vulnerability with a CVSS score of 8.8 (HIGH). ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the actual permission. It’s easy for?users to?i...

How severe is CVE-2022-23139?

CVE-2022-23139 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-23139?

Check the references section above for vendor advisories and patch information. Affected products include: Zte Zxmp M721 Firmware, Zte Zxmp M721.