CVE-2022-23144
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission...
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.
- Record
CVE-2022-23144- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
CVE List
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.
- Record
CVE-2022-23144- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2022-28235
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.
- Record
EUVD-2022-28235- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4xjp-gp7m-jj8v
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission...
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.
- Record
GHSA-4xjp-gp7m-jj8v- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
- zte zxa10 b700v7 firmware
- zte zxa10 b710c-a12 firmware
- zte zxa10 b710s2-a19 firmware
- zte zxa10 b766v2 firmware
- zte zxa10 b76hv3 firmware
- zte zxa10 b800v2 firmware
- zte zxa10 b836ct-a15 firmware
- zte zxa10 b860av2.1 firmware
- zte zxa10 b860h firmware
- zte zxa10 b866v2-h firmware
- zte zxa10 b866v5-w10 firmware
- zte zxa10 b960gv1 firmware
Show 3 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23144 is a critical vulnerability (CVSS 9.1) in Zte Zxa10 B700v7 Firmware, published September 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. No source names a fixed version.