What is CVE-2022-23139?

CVE-2022-23139 is a high-severity vulnerability in Zte Zxmp M721, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2022-05-12.

How severe is CVE-2022-23139?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2022-23139 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Zte Zxmp M721

CVE-2022-23139

ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the actual permission. It’s easy for?users to?ignore the modification?of?the file permission configuration, so that low-authority accounts could actually obtain higher operating permissions on key files.

Vulnerability class: Broken Access Control

EPSS: 0.007 (50.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Zte Zxmp_m721
Zte Zxmp_m721_firmware — versions 5.10.030.006
N/a Zxmp M721 — versions V5.10.030.006

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

Public proof-of-concept exploits

karimhabush/cyberowl

References

psirt@zte.com.cn (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-23139?: CVE-2022-23139 is a high-severity vulnerability in Zte Zxmp M721, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2022-05-12.
How severe is CVE-2022-23139?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2022-23139 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.