Read the docs
TI-2023-10930 Aliases CVE-2023-25649GHSA-g68x-2w79-87x5

OS Command Injection Vulnerability in a Mobile Internet Product of ZTE

Priority MEDIUM 44CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01861 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZTEMF286RCR_LVWRGBMF286RV1.0.0B04—No fix listedCNA
  • MF286R VendorZTE Affected CR_LVWRGBMF286RV1.0.0B04 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:zte:mf286r_firmware:cr_lvwrgbmf286rv1.0.0b04:*:*:*:*:*:*:*cr_lvwrgbmf286rv1.0.0b04VulnerableZTE
cpe:2.3:h:zte:mf286r:-:*:*:*:*:*:*:*not specified by NVDRunning onZTE
  • cpe:2.3:o:zte:mf286r_firmware:cr_lvwrgbmf286rv1.0.0b04:*:*:*:*:*:*:* Versions cr_lvwrgbmf286rv1.0.0b04 Vulnerable ·ZTE
  • cpe:2.3:h:zte:mf286r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ZTE

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25649
  2. 2026-10-03 Alias added: GHSA-g68x-2w79-87x5

References

Advisory 1

  • TI-2022-18458 SQL injection in MF286R CVSS 3.1HIGH 8.8
  • TI-2022-18465 Command injection in MF286R CVSS 3.1CRITICAL 9.8
  • TI-2023-10932 SQL Injection Vulnerability in Some ZTE Mobile Internet Products CVSS 3.1HIGH 8.0
  • TI-2022-18459 Buffer overflow in MF286R CVSS 3.1MEDIUM 6.5
  • TI-2022-18464 SQL injection in MF286R,MF289D CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences