Deviceways

Travel router

ZTE MF286R

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
Hardware revision not specified
Get OpenWrt firmware Release listed · 25.12.6
Hardware revision not specified
Open hardware record Release listed · 25.12.5
Original project github.com

Recorded configuration: 2/128NAND MB flash; 128 MB RAM

Limitations
volte fxs
First installation
U-Boot TFTP + serial recovery
Limitations
volte
Limitations
fxs
Sources

Features & details

Check the project and hardware shown for each feature.

OpenWrt

OpenWrt — Source documentation (openwrt.org)

Installation routes recorded
U-Boot TFTP + serial recovery
Recovery routes recorded
U-Boot TFTP + serial recovery
Availability recorded by source
Available 2022

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 9.8 (v3.1)

MF286R

There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.

CVE-2022-39073

Affected firmware
Nordic_MF286R_B06,
Fix
Fix details in the linked record
Read zte CVE record
Details and sources
CVE updated

There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.

CVE published

CVSS 8.8 (v3.1)

MF286R

There is a SQL injection vulnerability in ZTE MF286R

CVE-2022-39066

Affected firmware
Nordic_MF286R_B06
Fix
Fix details in the linked record
Read zte CVE record
Details and sources
CVE updated

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.

CVE published

CVSS 6.8 (v3.1)

MF286R

OS Command Injection Vulnerability in a Mobile Internet Product of ZTE

CVE-2023-25649

Affected firmware
CR_LVWRGBMF286RV1.0.0B04
Fix
CR_LVWRGBMF286RV1.0.1B01
Read zte CVE record
Details and sources
Public disclosure CVE updated

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.

CVE published

CVSS 6.5 (v3.1)

MF286R

There is a buffer overflow vulnerability in ZTE MF286R

CVE-2022-39067

Affected firmware
Nordic_MF286R_B06
Fix
Fix details in the linked record
Read zte CVE record
Details and sources
CVE updated

There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticated attacker could use the vulnerability to perform a denial of service attack.

Check more security advisories for this device · CVE.org