EUVD-2026-68455
GHSA-3cc6-hwr4-f668
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent management-network reach (AV:A) with authentication bypass (PR:N) yields root command execution; scope change (S:C) reflects impact propagating to the controlled power system, C/I/A all High.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
Lifecycle Timeline
2DescriptionCVE.org
Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tampering with critical system parameters and triggering abnormal operation of the entire power system.
AnalysisAI
Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent-network access (CVSS AV:A)-the attacker must reach the device's management interface on the same or a directly connected network segment, not across the open internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.6) indicates a low-complexity, unauthenticated attack from an adjacent network with full confidentiality/integrity/availability impact and a scope change into the wider power system-consistent with root compromise of a controller that governs other equipment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the ZTE security bulletin (https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/874505866159002595) and apply the vendor-provided firmware update for ZXDU68 S202 V5.0; the input data does not include an exact fixed version, so treat the specific patched build as 'Patch available per vendor advisory' and confirm the version with ZTE support before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today