ZTE PROCESS Guard Service CVE-2026-40001

Exploitation requires the following specific, concrete conditions: The ZTE PROCESS Guard Service must be installed and running on the target system as part of the ZTE cloud computer client. The attacker must possess a valid local user account with login credentials (authenticated local user session). No special service configuration or feature enablement is required-the vulnerability exists in the core access control logic. The attack does not require user interaction (UI:N per CVSS vector) once the attacker has local session access. Exploitation is limited to local system access only (AV:L) and cannot be performed remotely over network protocols. The vulnerability's impact is further constrained by the scope crossing (S:C), meaning exploitation affects the broader system but the attacker's initial privileges remain at user level (PR:L), limiting the attack to privilege escalation pathways available through the service.

Risk assessment reveals a moderate real-world threat with clear limiting factors. The CVSS score of 5.2 (medium) with CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L indicates local-only attack vector with low complexity and low privileges required, but limited impact scope (integrity and availability only, no confidentiality). The authenticated user requirement (PR:L) significantly limits exploitation compared to unauthenticated vectors-any attacker must first obtain local system access and valid credentials. However, AC:L (low complexity) and UI:N (no user interaction) mean that once a legitimate user account exists, exploitation is straightforward and reliable. The scope crossing (S:C) is the primary concern, as it demonstrates privilege escalation beyond the user's intended permissions. Without EPSS score, SSVC data, or KEV listing, risk must be assessed through CVSS signals alone: this is not a critical remote code execution but rather a privilege escalation risk for multi-user systems or scenarios where lower-privileged service accounts are compromised. Organizations with strong local access controls and limited local user bases face lower risk; those with many local users or shared systems face higher risk. No public exploit code or active exploitation has been identified, further reducing immediate threat level.

An attacker with a legitimate local user account on a system running ZTE cloud computer client authenticates to the system, then exploits the PROCESS Guard Service's improper access control to escalate privileges by manipulating the service's authorization checks. The attacker leverages the path traversal vulnerability to access or modify files outside the service's intended directory scope, achieving code execution in the elevated context of the PROCESS Guard Service. The attack succeeds without requiring user interaction or additional authentication beyond the initial system access.