EUVD-2026-68455
GHSA-3cc6-hwr4-f668
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent management-network access
-
DeliveryReach ZXDU68 S202 management interface
-
ExploitBypass authentication
-
ExecutionInject OS commands as root
-
PersistDelete runtime files and dump SNMP credentials
-
ImpactTamper power-system parameters
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires adjacent-network access (CVSS AV:A)-the attacker must reach the device's management interface on the same or a directly connected network segment, not across the open internet. Per PR:N and the Authentication Bypass tag, no valid credentials are needed because the flaw circumvents authentication before triggering command injection; AC:L and UI:N mean no user interaction and no special timing are required. The limiting factors are therefore network position (must be on the site/management LAN reachable to ZXDU68 S202 V5.0) and having reachability to the vulnerable management service; exploitation is confined to the ZXDU68 S202 V5.0 platform. |
| Impact | The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.6) indicates a low-complexity, unauthenticated attack from an adjacent network with full confidentiality/integrity/availability impact and a scope change into the wider power system-consistent with root compromise of a controller that governs other equipment. The key limiter is AV:A: the attacker must be on the same logical/adjacent network segment (e.g., the site management LAN), not the open internet, which meaningfully constrains mass exploitation. No EPSS score, KEV listing, or POC is provided, so despite the high CVSS this is not confirmed to be under active or widespread exploitation-treat it as high-severity-by-impact but currently unproven-in-the-wild. The CWE-287 vs. command-injection framing is a minor inconsistency to verify with ZTE's bulletin, but it does not lower the impact assessment. |
| Exploit ScenarioDerived | An attacker who gains a foothold on the telecom site's management network (e.g., via a compromised adjacent host or jump box) sends a crafted request to the ZXDU68 S202 management interface, bypassing authentication and injecting OS commands. Running as root, they delete core runtime files to paralyze monitoring and dump the SNMP and configuration credentials, then alter power-plant parameters to induce abnormal operation. No POC is published, but the low attack complexity means a knowledgeable insider or lateral attacker could reproduce it once on-segment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV.
RemediationAI
Consult the ZTE security bulletin (https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/874505866159002595) and apply the vendor-provided firmware update for ZXDU68 S202 V5.0; the input data does not include an exact fixed version, so treat the specific patched build as 'Patch available per vendor advisory' and confirm the version with ZTE support before deployment. Because the attack vector is adjacent-network, the most effective compensating control is network isolation: place the monitoring unit on a dedicated, access-controlled management VLAN and restrict L2/L3 reachability to a small set of trusted engineering hosts (trade-off: legitimate remote monitoring tooling must be explicitly allowlisted). Additionally, disable or firewall unnecessary management services, block untrusted access to the device's web/management and SNMP ports, and rotate all SNMP community strings and device credentials after patching since they may already be exposed. Monitor for unexpected deletion or restart of the monitoring process as a detection signal.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The ZXDU68 S202 is an embedded communication/DC power supply and environment monitoring unit used in telecom sites; its management interface exposes functionality that fails to properly authenticate requests (CWE-287, Improper Authentication) and passes attacker-controlled input into system command execution (command injection). The combination means an attacker who bypasses authentication can run OS-level commands as root on the monitoring controller. Because the monitoring module governs SNMP configuration and power parameters, code execution on it directly exposes stored device secrets and control logic. Note the root-cause signals partially conflict: the assigned CWE is CWE-287 (authentication) while the description and tags emphasize command injection-both appear to chain together in this advisory.
Know when Zxdu68 S202 V5 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent management-network reach (AV:A) with authentication bypass (PR:N) yields root command execution; scope change (S:C) reflects impact propagating to the controlled power system, C/I/A all High.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
DescriptionCVE.org
Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tampering with critical system parameters and triggering abnormal operation of the entire power system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB