EUVD-2026-28243
GHSA-53wr-r4p3-wrc5
Severity by source
AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.
AnalysisAI
ZTE Cloud PC client uSmartview contains an OpenSSL configuration file privilege escalation vulnerability (CVE-2026-40004) that allows authenticated local attackers with user-level privileges to execute arbitrary code and escalate to higher privilege levels through a malicious openssl.cnf file. This requires physical access or local system access combined with user interaction, and affects ZTE's virtualized desktop infrastructure product. The CVSS score of 5.5 reflects the physical attack vector and additional user interaction requirement, despite the severity of code execution and cross-system scope impact.
Technical ContextAI
The vulnerability exists in how ZTE uSmartview (tracked under CPE cpe:2.3:a:zte:zxcloud_irai) handles OpenSSL configuration file loading. OpenSSL allows configuration directives to be loaded from openssl.cnf files, and if an attacker can control or modify the configuration file in the client's search path, arbitrary code execution becomes possible through OpenSSL engine or module loading mechanisms. CWE-427 (Uncontrolled Search Path Element) indicates that the application searches for openssl.cnf in directories where an attacker with local access can place a malicious configuration file, or fails to properly validate the file's integrity and origin before loading it. This is a classic privilege escalation vector where a low-privilege local user exploits the application's trust in configuration files to gain higher privilege execution context.
RemediationAI
Apply the security patch released by ZTE as documented in the support bulletin (https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3126272076755775573) - exact patch version not specified in available data. As a compensating control prior to patching, restrict file system permissions on the directory where uSmartview loads openssl.cnf to prevent non-administrator users from creating or modifying files in that location (typically the application installation directory and system OpenSSL config paths). Audit and verify the integrity of all openssl.cnf files in search paths used by uSmartview to detect unauthorized modifications. For high-risk environments, disable local OpenSSL configuration file loading in uSmartview if such a configuration option exists, though this may impact certificate handling or advanced TLS features. These controls add administrative overhead and do not fully remediate the issue, so patching remains the primary remediation path.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today