by Kastro
Paper/Archive/CVE-2022-23144

CVE-2022-23144

zte — There is a broken access control vulnerability in ZTE ZXvSTB product.

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (NVD, ADP agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 56.3.563 × 2011.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.

Affected

ProductAffectedFixed inSource
ZXvSTBAll versions up to ZXvSTB-CAMSV2.01.02.01–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026224