{"id":"CVE-2023-25651","aliases":["EUVD-2023-29590","GHSA-88g9-2h5w-9543"],"status":"published","title":"SQL Injection Vulnerability in Some ZTE Mobile Internet Products","description":"There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00342,"percentile":0.28132,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-89"],"published":"2023-12-14T07:03:54Z","modified":"2026-06-17T05:41:39Z","products":[{"vendor":"zte","product":"mf286r_firmware"},{"vendor":"zte","product":"mf833u1_firmware"},{"vendor":"zte","product":"mobile internet products"}],"references":[{"url":"https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032684","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25651"},{"url":"https://github.com/advisories/GHSA-88g9-2h5w-9543"}],"sources":{"cve":[{"id":"CVE-2023-25651","title":"SQL Injection Vulnerability in Some ZTE Mobile Internet Products","description":"\nThere is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.\n\n","status":"published","published":"2023-12-14T07:03:54.704Z","modified":"2024-08-02T11:25:19.271Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29590","description":"\nThere is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.\n\n","status":"published","published":"2023-12-14T07:03:54Z","modified":"2024-08-02T11:25:19Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:07.32318Z"}],"ghsa":[{"id":"GHSA-88g9-2h5w-9543","title":"\nThere is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient...","description":"\nThere is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.\n\n","status":"published","published":"2023-12-14T09:30:19Z","modified":"2023-12-28T05:05:03Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-20","CWE-89"],"updated_at":"2026-11-02T14:55:16.928981Z"}],"nvd":[{"id":"CVE-2023-25651","description":"\nThere is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.\n\n","status":"published","published":"2023-12-14T07:15:08.27Z","modified":"2026-06-17T05:41:39.763Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-89"],"updated_at":"2026-11-02T14:08:54.696438Z"}]}}