CVE-2023-25643

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Dec 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-256447.5There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, CVE-2023-256457.7There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged appliCVE-2023-256466.4There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common useCVE-2023-256473.3There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phoCVE-2023-256487.8There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary userCVE-2023-256498.8There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface pCVE-2023-25656.1A vulnerability has been found in SourceCodester Multi Language Hotel Management Software 1.0 and classified as problematic. This vulnerabilCVE-2023-256506.5There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an aCVE-2023-256518.0There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameterCVE-2023-256527.5Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40CVE-2023-256537.5node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior CVE-2023-256549.8baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management syst