Description
All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation, an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection attacks on the devices.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZTE | MF65 | unspecified – ≤ V1.0.0B05 | — |
| ZTE | MF65M1 | unspecified – ≤ V1.0.0B02 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- ZTE MF65 BD_HDV6MF65V1.0.0B05 - Cross-Site Scripting EDB-46102 · webapps · Jan 9, 2019
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.