Lucene search

[email protected]CVE-2023-25650

HistoryDec 14, 2023 - 7:15 a.m.

CVE-2023-25650

2023-12-1407:15:07

NVD-CWE-noinfo

CWE-20

[email protected]

web.nvd.nist.gov

cve-2023-25650

arbitrary file download

zxcloud irai

vulnerability

information security

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.0005 Low

EPSS

Percentile

16.8%

JSON

There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads.

CPENameOperatorVersion
zte:zxcloud_irai_firmwarezte zxcloud irai firmwarelt7.23.30
zte:zxcloud_irai_firmwarezte zxcloud irai firmwareeq7.23.20
zte:zxcloud_irai_firmwarezte zxcloud irai firmwareeq7.23.21
zte:zxcloud_irai_firmwarezte zxcloud irai firmwareeq6.03.04
zte:zxcloud_irai_firmwarezte zxcloud irai firmwareeq7.23.23
zte:zxcloud_irai_firmwarezte zxcloud irai firmwareeq-

CPE	Name	Operator	Version
zte:zxcloud_irai_firmware	zte zxcloud irai firmware	lt	7.23.30
zte:zxcloud_irai_firmware	zte zxcloud irai firmware	eq	7.23.20
zte:zxcloud_irai_firmware	zte zxcloud irai firmware	eq	7.23.21
zte:zxcloud_irai_firmware	zte zxcloud irai firmware	eq	6.03.04
zte:zxcloud_irai_firmware	zte zxcloud irai firmware	eq	7.23.23
zte:zxcloud_irai_firmware	zte zxcloud irai firmware	eq	-

References

support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032904

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.0005 Low

EPSS

Percentile

16.8%

JSON

Related for CVE-2023-25650

cvelist1 prion1