CVE-2021-21738

Name of the Vulnerable Software and Affected Versions ZTE ZXIPTV version 5.06.04.09 ZTE ZXIPTV-EAS version 5.06.04.09

Description The issue is related to two reflective cross-site scripting (XSS) vulnerabilities in ZTE's big video business platform. These vulnerabilities are caused by insufficient input verification, allowing an attacker to implement XSS attacks by tampering with parameters. This could affect the operations of valid users.

Recommendations For ZTE ZXIPTV version 5.06.04.09, update to a version that includes input verification to prevent XSS attacks. For ZTE ZXIPTV-EAS version 5.06.04.09, update to a version that includes input verification to prevent XSS attacks. As a temporary workaround, consider restricting access to parameters that can be tampered with to minimize the risk of exploitation.