CVE-2024-22065

8.8 highEPSS 1.2%

High (8.8) in zte mf258k pro firmware. EPSS 1.2% chance of exploitation in the next 30 days.

There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-20
Published: 2024-10-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zte:mf258k_pro_firmware

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1171513586716225572

Check your stack JSON