ZXCLOUD iRAI CVE-2026-40004

The attacker must already have local, low-privileged access to a host running the ZXCLOUD iRAI / uSmartview Cloud PC client (CVSS PR:L, AV:L), and must be able to write or redirect the openssl.cnf that the client loads from its search path (CWE-427); OpenSSL config loading is then abused to run attacker code in the client's context. No user interaction is required (UI:N). Limiting factors: it is not remotely exploitable, it needs a pre-existing local foothold, and the exact writable directory/trigger is not described in the available sources, so successful exploitation depends on the client's install/search-path configuration.

This is a locally-exploitable privilege escalation (CWE-427, uncontrolled/insecure search path) in ZTE's ZXCLOUD iRAI / uSmartview Cloud PC client, where the application loads an openssl.cnf that an attacker can control. The supplied CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms it is NOT remotely reachable: it requires local access and an already-authenticated low-privileged account (PR:L), with no user interaction, yielding full confidentiality, integrity and availability impact (C:H/I:H/A:H) - hence the 7.8. The real-world signals all point to LOW urgency despite the high base score: EPSS is 0.01% (3rd percentile), SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public exploit reference in the provided data. The vuln.today Decision label is 'this_week', which is a moderate (not emergency/act_now) priority. The one point to note is a tag/vector mismatch: the input Tags include 'RCE', but the CVSS vector is AV:L and the description explicitly says the attacker 'executes arbitrary code locally' - this is local privilege escalation, not remote code execution; treat any 'RCE' framing with caution. Net: a genuine but not widespread-exploitation priority - patch on a normal/this-week cycle for affected endpoints rather than as an emergency.

A low-privileged local user (or malware already running at low integrity) on a machine with the ZXCLOUD iRAI / uSmartview client plants a malicious openssl.cnf in a location the client reads, abusing OpenSSL's configuration/engine loading to run attacker-controlled code in the privileged context of the client. No user interaction is required, but the attacker must already have local low-privileged access. No public exploit code was identified in the provided data.