CVE-2022-39066: There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated…

PriorityP267high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

26.54%

97.8th percentile

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zte	mf286r_firmware	< mf286r_b07	mf286r_b07
zte	mf286r_firmware	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.