There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user\'s input, an attacker could exploit this vulnerability to escalate local privileges.
Metrics
CVSS Version: 3.1 |
Base Score: 6.4 MEDIUM Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
l➤ Exploitability Metrics: Attack Vector (AV)* LOCAL Attack Complexity (AC)* HIGH Privileges Required (PR)* HIGH User Interaction (UI)* NONE Scope (S)* UNCHANGED
l➤ Impact Metrics: Confidentiality Impact (C)* HIGH Integrity Impact (I)* HIGH Availability Impact (A)* HIGH
Weakness Enumeration (CWE)
CWE-ID: CWE-22 CWE Name: CWE-22 Improper Limitation of a Pathname to a Restricted Directory (
Path Traversal
) Source: ZTE
Common Attack Pattern Enumeration and Classification (CAPEC)
CAPEC-ID: CAPEC-1 CAPEC Description: CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs