There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation.
References
| Link | Resource |
|---|---|
| https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
History
26 Jun 2023, 22:19
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Zte zxv10 B866v2f Firmware
Zte zxv10 B866v2 Firmware Zte zxv10 B866v2-h Firmware Zte Zte zxv10 B866v2 Zte zxv10 B860h V5d0 Firmware Zte zxv10 B860h V5d0 Zte up T2 4k Firmware Zte up T2 4k Zte zxv10 B866v2f Zte zxv10 B866v2-h |
|
| CPE | cpe:2.3:o:zte:zxv10_b866v2_firmware:v82815416.2012:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0069:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0049:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2_firmware:v84711309.0016:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2_firmware:v82815416.1027:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2-h_firmware:v84711321.0045:*:*:*:*:*:*:* cpe:2.3:h:zte:up_t2_4k:-:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2_firmware:v82815416.1029:*:*:*:*:*:*:* cpe:2.3:h:zte:zxv10_b860h_v5d0:-:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2-h_firmware:v84711321.0038:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2_firmware:v82815416.1028:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2_firmware:v84711309.0018:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2-h_firmware:v84711321.0040:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2f_firmware:v86111338.0031:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2_firmware:v84711309.0019:*:*:*:*:*:*:* cpe:2.3:h:zte:zxv10_b866v2-h:-:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0051:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2-h_firmware:v84711321.0049:*:*:*:*:*:*:* cpe:2.3:h:zte:zxv10_b866v2:-:*:*:*:*:*:*:* cpe:2.3:h:zte:zxv10_b866v2f:-:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0063:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2f_firmware:v86111338.0033:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2f_firmware:v86111338.0026:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b860h_v5d0_firmware:v83011303.0053:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2f_firmware:v86111338.0035:*:*:*:*:*:*:* cpe:2.3:o:zte:up_t2_4k_firmware:v84511302.1427:*:*:*:*:*:*:* cpe:2.3:o:zte:zxv10_b866v2_firmware:v82811306.3021:*:*:*:*:*:*:* |
|
| References | (MISC) https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1031464 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.7 |
| CWE | CWE-276 |
16 Jun 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-16 19:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-25645
Mitre link : CVE-2023-25645
CVE.ORG link : CVE-2023-25645
JSON object : View
Products Affected
zte
- zxv10_b860h_v5d0
- up_t2_4k_firmware
- zxv10_b866v2-h
- zxv10_b866v2
- zxv10_b866v2-h_firmware
- zxv10_b866v2_firmware
- zxv10_b860h_v5d0_firmware
- zxv10_b866v2f
- up_t2_4k
- zxv10_b866v2f_firmware
CWE
CWE-276
Incorrect Default Permissions