Vulnerability Spotlight: Multiple vulnerabilities in ZTE Portable Router

guest · Oct 19, 2021

Vulnerability Spotlight: Multiple vulnerabilities in ZTE MF971R LTE router
October 18, 2021
https://blog.talosintelligence.com/2021/10/vuln-spotlight-.html

Cisco Talos recently discovered multiple vulnerabilities in the ZTE MF971R LTE portable router.

The MF971R is a portable router with Wi-Fi support and works as an LTE/GSM modem. An attacker could exploit all these vulnerabilities by sending a specially crafted HTTP request to the targeted device.
Click to expand...

TALOS-2021-1320 and TALOS-2021-1321 are stack-based buffer overflow vulnerabilities. An attacker could exploit these issues to execute arbitrary remote code on the targeted device. As part of these exploits, the attacker needs to complete a referrer bypass, which is outlined in TALOS-2021-1317.

TALOS-2021-1318 and TALOS-2021-1319 are cross-site scripting vulnerabilities that an attacker could use to execute arbitrary JavaScript in the victim’s browser. In this case, an attacker would need to trick the user into opening an attacker-controlled URL that hosts the malicious HTTP request.
An adversary could also exploit TALOS-2021-1316 to cause a configuration file entry overwrite.
Click to expand...

Lastly, there is TALOS-2021-1313, a CRLF injection vulnerability in the router. The victim does not need to be logged in for an adversary to exploit this vulnerability.
Click to expand...

Log in or Sign up

Vulnerability Spotlight: Multiple vulnerabilities in ZTE Portable Router

guest Guest

Log in or Sign up

Vulnerability Spotlight: Multiple vulnerabilities in ZTE Portable Router

guest Guest

Useful Searches