#VU63188 Path traversal


Published: 2022-05-16

Vulnerability identifier: #VU63188

Vulnerability risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23135

CWE-ID: CWE-22

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
ZXHN F477
Hardware solutions / Routers for home users
ZXHN F677
Hardware solutions / Routers for home users

Vendor: ZTE

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and modify the FTP access path, obtain sensitive information, and perform a denial of service attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

ZXHN F477: 9.0.0P1N28

ZXHN F677: 9.0.0P1N28


CPE

External links
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1023444


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability