CVE-2020-6872

MEDIUM

ZTE R5300G4/R5500G4/R8500G4 Firmware - Stored Cross-Site Scripting via Login Page

Title source: llm
STIX 2.1

Description

The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>.

References (1)

Core 1

Scores

CVSS v3 6.1
EPSS 0.0042
EPSS Percentile 62.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (21)
zte/r5300g4_firmware 03.04.0020
zte/r5300g4_firmware 03.05.0040
zte/r5300g4_firmware 03.05.0043
zte/r5300g4_firmware 03.05.0044
zte/r5300g4_firmware 03.05.0045
zte/r5300g4_firmware 03.05.0046
zte/r5300g4_firmware 03.05.0047
zte/r5300g4_firmware 03.07.0100
zte/r5300g4_firmware 03.07.0108
zte/r5300g4_firmware 03.07.0200
... and 11 more
Published Jul 20, 2020
Tracked Since Feb 18, 2026