CVE-2020-6872

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 20, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-68735.3A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets with valid http linkCVE-2020-68749.1A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers coulCVE-2020-68759.8A ZTE product is impacted by the improper access control vulnerability. Due to lack of an authentication protection mechanism in the programCVE-2020-68765.4A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEBCVE-2020-68778.8A ZTE product is impacted by an information leak vulnerability. An attacker could use this vulnerability to obtain the authentication passwoCVE-2020-68793.5Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. TCVE-2020-68809.8A ZXELINK wireless controller has a SQL injection vulnerability. A remote attacker does not need to log in. By sending malicious SQL statemeCVE-2020-68817.5ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of CVE-2020-68827.5ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials oCVE-2020-69177.8Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified iCVE-2020-69187.8Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified iCVE-2020-69197.8Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified i