CVE-2022-23135
Medium
Description
There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destination path, an attacker with specific permissions could modify the FTP access path to access and modify the system path contents without authorization, which will cause information leak and affect device operation.
SeverityMedium
CVSS6.5
Exploit probability—
ProductZte Zxhn F677 Firmware
PublishedFeb 24, 2022
First seenFeb 24, 2022
How to fix
Update
- zte zxhn_f677_firmware9.0.0p1n29 or later
- zte zxhn_f477_firmware9.0.0p1n29 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zte zxhn_f677_firmware | v < 9.0.0p1n29 | 9.0.0p1n29 |
| zte zxhn_f477_firmware | v < 9.0.0p1n29 | 9.0.0p1n29 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.