CVE-2020-6871

The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. This affects: <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
zteCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
VendorProductVersion
zter8500g4_firmware
03.05.0020
zter8500g4_firmware
03.05.0400
zter8500g4_firmware
03.06.0100
zter8500g4_firmware
03.07.0101
zter8500g4_firmware
03.07.0103
zter5500g4_firmware
03.06.0100
zter5500g4_firmware
03.07.0100
zter5500g4_firmware
03.07.0200
zter5500g4_firmware
03.08.0100
zter5300g4_firmware
03.04.0020
zter5300g4_firmware
03.05.0040
zter5300g4_firmware
03.05.0043
zter5300g4_firmware
03.05.0044
zter5300g4_firmware
03.05.0045
zter5300g4_firmware
03.05.0046
zter5300g4_firmware
03.05.0047
zter5300g4_firmware
03.07.0100
zter5300g4_firmware
03.07.0108
zter5300g4_firmware
03.07.0200
zter5300g4_firmware
03.07.0300
zter5300g4_firmware
03.08.0100
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203