CVE-2023-41781: ZTE MF258 · Improper Input Validation
Affects ZTE MF258Source CVE Database V5
Not known to be exploited · CVSS 5.7 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 25% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 10 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
To mitigate this vulnerability effectively, European organizations should implement the following specific measures: 1) Restrict access to the ZTE MF258 management interface strictly to trusted and authenticated users, preferably via VPN or secure management VLANs, to reduce the risk of adjacent network exploitation. 2) Enforce strong privilege management and monitor for any unauthorized privilege escalations on the device to prevent attackers from obtaining the high privileges needed for exploitation. 3) Employ network segmentation to isolate the device from general user networks, limiting potential attack vectors. 4) Use Web Application Firewalls (WAFs) or Intrusion Detection/Prevention Systems (IDS/IPS) configured to detect and block suspicious input patterns targeting the SMS interface or web management portal. 5) Regularly audit device logs and network traffic for anomalous activity indicative of exploitation attempts. 6) Engage with ZTE support channels to obtain updates on patches or firmware upgrades addressing this vulnerability and plan timely deployment once available. 7) Educate network administrators about the risks of XSS in network devices and the importance of secure configuration and monitoring.
Description
There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.