EUVD-2026-66341
GHSA-xhr9-v6fq-9x9p
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
AV:A matches management-plane targeting; PR:L reflects required valid credentials; C:H from arbitrary SQL read; I:N as no write path is described; A:L from query slowdown only.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitation threshold, wide scope of impact, requires no external privilege escalation, and is classified as a high-priority fix.
AnalysisAI
SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: a valid low-privileged ZTE SCP user account (PR:L - the description explicitly states 'legitimate user credentials in hand'), and adjacent network access to the SCP management interface (AV:A - the attacker must share a network segment such as a management VLAN or internal operator network). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.3 reflects meaningful but bounded risk: adjacent-network positioning (AV:A) and pre-existing valid credentials (PR:L) are non-trivial prerequisites that significantly narrow the attacker population compared to a fully remote, unauthenticated flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or lateral-movement attacker with a valid low-privileged ZTE SCP account injects SQL payloads into user-controlled input fields in the SCP interface, causing the application to execute queries beyond the intended authorization boundary. This enables reading of sensitive database records - such as subscriber data, device credentials, or network configuration - that the account should not access. … |
| Remediation | Apply the patch or upgrade referenced in ZTE's security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7440762086373310571; no specific fixed version number has been independently confirmed from available data (patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today