CVE-2020-6868

{"containers": {"cna": {"affected": [{"product": "ZTE F680", "vendor": "n/a", "versions": [{"status": "affected", "version": "ZXHN F680V9.0.10P1N6"}]}], "datePublic": "2020-05-08T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The front-end limits the length of the WAN connection name that is created, but the HTTP proxy is available to be used to bypass the limitation. An attacker can exploit the vulnerability to tamper with the parameter value. This affects: ZTE F680 V9.0.10P1N6"}], "problemTypes": [{"descriptions": [{"description": "access control", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-12-04T21:36:56.000Z", "orgId": "6786b568-6808-4982-b61f-398b0d9679eb", "shortName": "zte"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012866"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@zte.com.cn", "ID": "CVE-2020-6868", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ZTE F680", "version": {"version_data": [{"version_value": "ZXHN F680V9.0.10P1N6"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The front-end limits the length of the WAN connection name that is created, but the HTTP proxy is available to be used to bypass the limitation. An attacker can exploit the vulnerability to tamper with the parameter value. This affects: ZTE F680 V9.0.10P1N6"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "access control"}]}]}, "references": {"reference_data": [{"name": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012866", "refsource": "MISC", "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012866"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:11:05.125Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012866"}]}]}, "cveMetadata": {"assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb", "assignerShortName": "zte", "cveId": "CVE-2020-6868", "datePublished": "2020-06-01T12:43:31.000Z", "dateReserved": "2020-01-13T00:00:00.000Z", "dateUpdated": "2024-08-04T09:11:05.125Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "ZTE F680", "vendor": "n/a", "versions": [{"status": "affected", "version": "ZXHN F680V9.0.10P1N6"}]}], "source": "psirt@zte.com.cn"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:f680_firmware:zxhn_f680v9.0.10p1n6:*:*:*:*:*:*:*", "matchCriteriaId": "A0A7B733-B37B-40E7-8006-6C439693859E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:f680:-:*:*:*:*:*:*:*", "matchCriteriaId": "B1B37CB7-FB8A-4CB6-A7D2-2CBB6B6DBCAF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The front-end limits the length of the WAN connection name that is created, but the HTTP proxy is available to be used to bypass the limitation. An attacker can exploit the vulnerability to tamper with the parameter value. This affects: ZTE F680 V9.0.10P1N6"}, {"lang": "es", "value": "Existe una vulnerabilidad de validaci\u00f3n de entrada en un producto terminal PON de ZTE, que soporta la creaci\u00f3n de conexiones WAN a trav\u00e9s de p\u00e1ginas de gesti\u00f3n WEB. El front-end limita la longitud del nombre de la conexi\u00f3n WAN que se crea, pero el proxy HTTP est\u00e1 disponible para ser utilizado para evitar la limitaci\u00f3n. Un atacante puede explotar la vulnerabilidad para manipular el valor del par\u00e1metro. Esto afecta: ZTE F680 V9.0.10P1N6"}], "id": "CVE-2020-6868", "lastModified": "2026-06-17T03:23:57.017", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-06-01T13:15:10.267", "references": [{"source": "psirt@zte.com.cn", "tags": ["Vendor Advisory"], "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012866"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012866"}], "sourceIdentifier": "psirt@zte.com.cn", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}