CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2022-39072
Medium (5.4) in zte. EPSS 0.3% chance of exploitation in the next 30 days.
There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zte:mf286r_firmware
- zte:mf289d_firmware