What is the CVSS score of CVE-2026-44406?

CVE-2026-44406 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

ZTE uSmartView CVE-2026-44406

EUVD-2026-28329 MEDIUM

Uncontrolled Search Path Element (CWE-427)

2026-05-07 zte

GHSA-wxrx-7hm4-9f7q

Zte Privilege Escalation RCE Buffer Overflow

5.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 07:45 vuln.today

CVE Published

May 07, 2026 - 06:49 nvd

MEDIUM 5.7

DescriptionCVE.org

ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.

AnalysisAI

DLL hijacking in ZTE Cloud PC client uSmartView allows unauthenticated local attackers to achieve arbitrary code execution and privilege escalation by planting a malicious DLL that is loaded by uSmartViewServiceAgent.exe running with SYSTEM privileges. The vulnerability requires local access but no authentication and affects multiple ZXCloud IRAI product versions. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The vulnerability exploits DLL search order hijacking (CWE-427), a Windows-specific attack vector where an executable searches for dynamically linked libraries in predictable locations before checking protected system directories. The vulnerable component uSmartViewServiceAgent.exe operates with SYSTEM-level privileges, making it an attractive target for privilege escalation attacks. When the service attempts to load a required DLL, an attacker with local file system access can place a malicious DLL in a directory earlier in the search path, causing the service to execute attacker-controlled code with elevated privileges. The ZXCloud IRAI platform (as identified by CPE) is ZTE's cloud-based infrastructure solution; uSmartView is its client component responsible for remote desktop or application delivery functionality.

RemediationAI

Apply the security patch released by ZTE as detailed in the official bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/8107253322107965601. Specific patched version numbers are not independently confirmed from available data; consult the ZTE support page for exact version numbers to upgrade to. As a compensating control pending patch deployment, restrict local file system write permissions on directories in the DLL search path for uSmartViewServiceAgent.exe, particularly the application installation directory and any paths referenced in the PATH environment variable. Implement application whitelisting policies to prevent unauthorized DLL loading. Disable or restrict access to the uSmartViewServiceAgent.exe service for users who do not require Cloud PC functionality, reducing the attack surface. Ensure users do not have administrator or system-level privileges on endpoints running uSmartView unless operationally necessary-the vulnerability requires local access, and standard user accounts with restricted write permissions significantly limit exploit feasibility.