CVE-2018-7355

6.1 mediumEPSS 1.9%

All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation, an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection attacks on the devices.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-09-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zte:mf65_firmware
zte:mf65m1_firmware

References

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483
https://www.exploit-db.com/exploits/46102/
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483
https://www.exploit-db.com/exploits/46102/

Check your stack JSON