ZTE uSmartView CVE-2026-44406

Local file system write access is required to place a malicious DLL in a directory that will be searched by uSmartViewServiceAgent.exe before the legitimate system library. The uSmartViewServiceAgent.exe service must be running or must start after the malicious DLL is placed. No user authentication is required; a local user account with write permissions to any directory in the service's DLL search path is sufficient. No user interaction is required-exploitation occurs automatically when the service loads the hijacked DLL. The vulnerability is limited to systems where ZXCloud IRAI uSmartView client is installed and the vulnerable service is enabled and running.

The CVSS 5.7 (medium) score reflects the local attack vector (AV:L) and lack of required authentication (PR:N), but indicates relatively lower impact with Confidentiality None, Integrity Low, and Availability Low. However, this CVSS rating significantly understates the real-world risk: a local attacker gaining SYSTEM privilege execution represents complete system compromise in practice. The score's low impact ratings appear inconsistent with the stated consequences (arbitrary code execution and privilege escalation), suggesting CVSS may not fully capture the threat. The absence of KEV listing and no public POC availability suggest either limited real-world exploitation or delayed security research disclosure. The key limiting factor is local access requirement-this is not a remote vulnerability and requires an attacker already present on the compromised system or able to place files on it. For organizations deploying ZTE Cloud PC with uSmartView on client endpoints, the practical risk depends on whether those endpoints have adequate local access controls and user privilege segmentation. The CVSS vector scope being Changed (S:C) indicates the vulnerability can affect resources beyond the vulnerable component, reinforcing the privilege escalation threat.

A local user or attacker who has gained initial access to a system running ZTE uSmartView identifies the DLL search path used by uSmartViewServiceAgent.exe. The attacker crafts a malicious DLL matching the expected library name and places it in an early search location such as the service's working directory. When the service starts or reloads, it loads the attacker's DLL and executes it with SYSTEM privileges, allowing full system compromise.