CVE-2022-23135
Published: 24 February 2022
Summary
CVE-2022-23135 is a medium-severity Path Traversal (CWE-22) vulnerability in Zte Zxhn F677 Firmware. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 41.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28226
Vulnerability details
There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destination path, an attacker with specific permissions could modify the FTP access path to access and modify the…
more
system path contents without authorization, which will cause information leak and affect device operation.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.