Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2023-25643

Two Vulnerabilities in Some ZTE Mobile Internet Products

High8.4EPSS 1.8%
Published
Updated
Reserved
Assigned by
zte

Description

There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Scores

CVSS scores of CVE-2023-25643, by who scored it
Scored byCVSSScoreVector
zteCNA (assigner)3.1High8.4CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Modified3.1High8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
1.8% · top 22% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.

Weakness

Affected products

  • ZTE · MC801A

    • affected MC801A_Elisa3_B19 – ≤ B19

  • ZTE · MC801A1

    • affected MC801A1_Elisa1_B04 – ≤ B04

What to do

Solution: MC801A_Elisa3_B22,  MC801A1_Elisa1_B06

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-25643 badge
[![CVE-2023-25643](https://trackcve.app/badge/CVE-2023-25643.svg)](https://trackcve.app/cve/CVE-2023-25643)

Record last updated .