CVE-2022-23144
Critical
Description
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.
SeverityCritical
CVSS9.1
Exploit probability—
ProductZte Zxa10 B76hv3 Firmware
PublishedSep 23, 2022
First seenSep 23, 2022
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zte zxa10_b76hv3_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b766v2_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b800v2_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b860av2.1_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b860h_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b866v2-h_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b866v5-w10_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b960gv1_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b710c-a12_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b710s2-a19_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b836ct-a15_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_s100v_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_s200a_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_s200t_firmware | v ≤ 2.01.02.01 | — |
| zte zxa10_b700v7_firmware | v ≤ 2.01.02.01 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.