CVE-2020-6872
Description
The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zte r8500g4_firmware | 03.05.0020, 03.05.0400, 03.06.0100, 03.07.0101, 03.07.0103 | — |
| zte r5500g4_firmware | 03.06.0100, 03.07.0100, 03.07.0200, 03.08.0100 | — |
| zte r5300g4_firmware | 03.04.0020, 03.05.0040, 03.05.0043, 03.05.0044, 03.05.0045, 03.05.0046, 03.05.0047, 03.07.0100, 03.07.0108, 03.07.0200, 03.07.0300, 03.08.0100 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.