ZTE ZXCDN CVE-2025-46581

Exploitation requires network reachability to a ZTE ZXCDN instance exposing the vulnerable Apache Struts-based interface; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are stated as prerequisites, so default-reachable deployments are exposed. The principal limiting factors are: (1) the attacker must be able to reach the affected service (ZXCDN nodes are typically deployed inside carrier/operator networks rather than the open internet, constraining the realistic attacker population), and (2) resulting command execution is confined to a NON-root service account per the description, limiting immediate privilege and requiring a further local privilege-escalation step for full host control. Exact vulnerable versions are not provided, so defenders cannot scope affected builds from this data alone.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and 9.8 base score describe a remotely exploitable, unauthenticated, low-complexity code-execution flaw - the classic profile of a high-priority RCE, consistent with CWE-94 and the vendor's 'Struts remote code execution' characterization. However, the real-world exploitation signals are comparatively modest: EPSS is only 0.80% (55th percentile), the vulnerability is NOT on CISA KEV, and no public proof-of-concept is referenced in the provided data, so there is no public exploit identified at time of analysis. One internal inconsistency to verify: the description states the attacker executes commands 'with non-root privileges,' which slightly tempers the Availability/Integrity impact implied by the vendor's C:H/I:H/A:H, since a non-root process is typically more constrained than the full-system compromise a 9.8 suggests - verify actual blast radius with ZTE. No SSVC decision data was provided. Net: for organizations running ZTE ZXCDN this is a genuine priority because the preconditions for exploitation are minimal (network, no auth), but the absence of KEV/POC and the low EPSS mean active mass exploitation is not currently evidenced; this is best treated as 'patch promptly' rather than 'emergency in-the-wild' at this time.

An attacker with network reachability to an internet- or carrier-network-exposed ZTE ZXCDN management/service interface sends a crafted request that abuses the underlying Apache Struts processing to inject and execute operating-system commands without authentication. Code runs in the context of the service account (non-root), giving the attacker a foothold on the CDN node for further lateral movement or content manipulation. No public exploit code is identified at time of analysis, and no user interaction is required.