CVE-2014-9020: Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII a...

Security readout for executives and security teams

CVE-2014-9020 is a cross-site scripting flaw in the Quick Stats page of ZTE ZXDSL 831 and 831CII DSL devices. An attacker could cause script or HTML to be stored or reflected through a domain-name setting. Business risk depends on whether these legacy devices are still deployed or remotely reachable. Exposure is most likely in environments still using ZTE ZXDSL 831 or 831CII devices, especially where the device web interface is reachable by untrusted users or networks. Organizations without these legacy models in inventory are unlikely to be affected. Treat this as a targeted legacy-device cleanup issue, not a broad emergency. Prioritize if affected devices support business connectivity, are internet-facing, or are administered from shared user networks. Mitigation focus: Inventory for ZTE ZXDSL 831 and 831CII devices.; Restrict access to device web administration interfaces.; Check ZTE or service-provider guidance for firmware or replacement advice..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.