CVE-2020-6868

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The front-end limits the length of the WAN connection name that is created, but the HTTP proxy is available to be used to bypass the limitation. An attacker can exploit the vulnerability to tamper with the parameter value. This affects: ZTE F680 V9.0.10P1N6

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-68698.1All versions up to 10.06 of ZTEMarket APK are impacted by an information leak vulnerability. Due to Activity Component exposure users can exCVE-2020-68708.0The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to CVE-2020-68719.8The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of theCVE-2020-68726.1The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground CVE-2020-68735.3A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets with valid http linkCVE-2020-68749.1A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers coulCVE-2020-68759.8A ZTE product is impacted by the improper access control vulnerability. Due to lack of an authentication protection mechanism in the programCVE-2020-68765.4A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEBCVE-2020-68778.8A ZTE product is impacted by an information leak vulnerability. An attacker could use this vulnerability to obtain the authentication passwoCVE-2020-68793.5Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. TCVE-2020-68809.8A ZXELINK wireless controller has a SQL injection vulnerability. A remote attacker does not need to log in. By sending malicious SQL statemeCVE-2020-68817.5ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of