VULNERABILITY INTELLIGENCE

CVE-2023-25650

CVSS score6.5 MEDIUM
EPSS probability0.59%
CISA KEVNot currently listed
Published2023-12-14
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads.

Weakness classification

  • psirt@zte.com.cn: CWE-20
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references