What is CVE-2022-39072?

CVE-2022-39072 is a medium-severity vulnerability in Zte Mf286r, classified under SQL Injection. CVSS score: 5.4/10. Published 2023-01-06.

How severe is CVE-2022-39072?

Medium severity. CVSS v3 base score is 5.4 out of 10.

SQL Injection in Zte Mf286r

CVE-2022-39072

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.

Vulnerability class: SQL Injection

EPSS: 0.003 (26.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Zte Mf286r
Zte Mf286r_firmware — versions nordic_mf286r_b06
Zte Mf289d
Zte Mf289d_firmware — versions cr_tmoczmf289dv1.0.0b07
N/a Mf286r,mf289d — versions Nordic_MF286R_B06, CR_TMOCZMF289DV1.0.0B07

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@zte.com.cn (Vendor Advisory)

Frequently asked questions

What is CVE-2022-39072?: CVE-2022-39072 is a medium-severity vulnerability in Zte Mf286r, classified under SQL Injection. CVSS score: 5.4/10. Published 2023-01-06.
How severe is CVE-2022-39072?: Medium severity. CVSS v3 base score is 5.4 out of 10.