Threat Investigation
Request a demo

CVE-2022-39066

High

Description

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.

SeverityHigh
CVSS8.8
Exploit probability—
ProductZte Mf286r Firmware
PublishedNov 22, 2022
First seenNov 22, 2022
Weakness typeCWE-89SQL injection

How to fix

Update
  • zte mf286r_firmwaremf286r_b07 or later

Affected products

ProductAffected versionsFixed in
zte mf286r_firmwarev < mf286r_b07mf286r_b07

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.