Zte
Monthly
Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.
Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV.
Improper access control in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) lets remote unauthenticated attackers reach functionality that should be permission-gated, allowing them to read and modify system configuration data beyond their authorization. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact but no availability impact, and the issue is tagged as an authentication bypass. EPSS is very low at 0.03% (9th percentile) and there is no public exploit identified at time of analysis.
Information disclosure in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) stems from an insecure cryptographic password scheme - such as hard-coded keys, weak encryption algorithms, or poor key management - that lets remote, unauthenticated attackers recover or tamper with protected data. The CVSS vector (AV:N/AC:H/PR:N) indicates network reachability without credentials but with high attack complexity, and the primary impact is confidentiality loss (C:H) with minor integrity and availability effects. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile).
Unauthorized information disclosure in the ZTE MU5250 mobile broadband modem (firmware BD_FLYMODEMMU5250V1.0.0B27) allows remote attackers to retrieve protected data because an access-control mechanism is improperly configured, exposing information without any authentication. No public exploit identified at time of analysis, and EPSS scores this at just 0.02% (5th percentile), consistent with CISA's SSVC assessment of no observed exploitation and only partial technical impact. Despite a network-reachable, no-authentication CVSS of 7.5, the vendor-reported issue reflects a device-specific misconfiguration rather than a broadly weaponized flaw.
Remote denial-of-service in ZTE home routers (H8102E, H168N, H167A, and 15 other models) allows unauthenticated network attackers to crash the web management interface via oversized HTTP POST request with application/x-www-form-urlencoded content, requiring physical device reboot to restore service. ZTE claims devices patched since March 2021, but operator firmware timelines vary. EPSS data not available; no active exploitation confirmed (not in CISA KEV). Publicly available exploit details exist via GitHub gist.
Remote unauthenticated attackers can retrieve plaintext administrator passwords and WLAN Pre-Shared Keys from ZTE ZXHN H298A (firmware 1.1) and H108N (firmware 2.6) routers via crafted HTTP requests to the web management interface. The vulnerability enables complete network compromise through credential theft without requiring authentication. Public exploit code exists (GitHub Gist), demonstrating active researcher interest, though no CISA KEV listing indicates targeted rather than widespread exploitation. EPSS data unavailable, but the combination of network attack vector, no authentication requirement, and credential exposure presents immediate risk to affected deployments.
Local privilege escalation in the Red Magic 11 Pro (NX809J) gaming smartphone through firmware V1.0.0B14MR1 allows a non-privileged installed application to invoke a sensitive service interface that fails to validate its callers, letting the app write files to specific device partitions and set writable system properties. Reported by ZTE/Nubia through their own support bulletin, the issue is rated CVSS 8.8 with a scope change (S:C) reflecting the crossing of the app-sandbox privilege boundary into system context. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.
Password reset vulnerability in ZTE ZXEDM iEMS cloud management portal allows authenticated attackers with low privileges to enumerate all user accounts and reset arbitrary user passwords. This authentication bypass enables unauthorized administrative operations across the entire EMS system. Attack requires user interaction and moderate complexity (CVSS AC:H), but no public exploit identified at time of analysis. CVSS 7.1 reflects high confidentiality, integrity, and availability impact within the vulnerable component's scope.
Unauthenticated credential disclosure in ZTE ZXHN H188A routers (versions V6.0.10P2_TE and V6.0.10P3N3_TE) allows local network attackers to retrieve sensitive credentials including default administrator passwords, WLAN PSK, and PPPoE credentials via the wizard interface, with some cases enabling unauthenticated configuration changes. No CVSS or EPSS data is available, and KEV status is unconfirmed; however, a publicly available technical analysis exists on GitHub indicating detailed exploitation methodology.
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to invoke system interfaces through reflection and retrieve sensitive information, because those interfaces lack robust invocation authentication and access control. Exploitation is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), with confidentiality impact only and no integrity or availability effect. No public exploit identified at time of analysis; the issue is classified under CWE-269 and tagged as privilege escalation, but the assessed impact is a moderate, local-only information-disclosure flaw rather than a high-priority remote threat.
Local information disclosure in ZTE Z80 Ultra devices allows an installed third-party application to capture device-related data returned by system interfaces that do not adequately restrict access. The issue requires local execution and user interaction to install or run the hostile app, and it needs no elevated privileges (PR:N), resulting in a low CVSS score of 3.3 with only confidentiality impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is best treated as low priority.
Information disclosure in ZTE Z80 Ultra allows a locally installed application to read device-related information by invoking framework methods that have insufficient access control. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) means an attacker needs local access and must persuade or trick the user into installing or interacting with a malicious app, with impact limited to confidentiality; there is no integrity or availability impact and no privilege gain, despite the 'Privilege Escalation' tag. No public exploit code is identified at time of analysis, and the issue is assessed as moderate and locally scoped.
Information disclosure in ZTE Z80 Ultra devices lets a locally installed malicious application read information through system callable functions that lack sufficient access control. This is a low-severity, low-priority local issue (CVSS 3.3) requiring user interaction, typically installing or launching the attacker's app, with only confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis.
ZTE Z80 Ultra allows a malicious third-party application installed on the device to hook exposed system APIs and read limited sensitive information, resulting in a low-severity information disclosure (CVSS 3.1 base score 3.3). The attack is local-only, requires user interaction to install the attacking app, and requires no special privileges (PR:N), with only a low confidentiality impact and no integrity or availability impact; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Information disclosure in ZTE Z80 Ultra (nubia Z80 Ultra) smartphones allows a local app to reflectively invoke a system interface that lacks the necessary access-control check and read otherwise-protected information, with no integrity or availability impact. The vendor rates this CVE-2026-108501 at CVSS 5.7 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), while the independent assessment treats it as a local, unauthenticated information-disclosure issue (CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) that requires code execution on the device via an attacker-controlled app. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is confined to the ZTE Z80 Ultra model.
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.
The ZTE SmartLife client application ships with a hardcoded cryptographic key stored in plaintext within its code, allowing anyone who obtains and reverse-engineers the app package to recover the key and decrypt the embedded account-server information. Exploitation is local in nature - the attacker must first acquire the application binary and perform static analysis - and what is exposed is backend account-server configuration data rather than per-user credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor scores this 6.2 with high confidentiality impact, while independent assessment rates confidentiality impact as Low, framing this as a defense-in-depth weakness rather than an urgent, remotely-weaponizable flaw.
Information disclosure in ZTE SmartLife allows an attacker who can extract the app's runtime-generated application authentication parameters to query the backend /account/verify.serv endpoint, confirm whether a target email address is registered, and retrieve the corresponding real backend account ID. The independent assessment treats the issue as network-reachable and unauthenticated from the backend's perspective because those parameters are obtainable by running or reverse-engineering the SmartLife client, though the practical impact is limited to email enumeration and account-ID leakage in ZTE's SmartLife ecosystem, not a full privilege escalation. No CISA KEV entry and no public exploit were identified at time of analysis.
ZTE SmartLife's backend signup interface (/account/person/signup.serv) creates accounts for arbitrary email addresses without verifying that the requester owns the address, so an attacker who has extracted the app's runtime-generated authentication parameters can complete registration against any email string. The assigned vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) and our independent assessment agree on moderate severity: the primary barrier is first obtaining the client-generated app authentication parameters - obtainable via reverse engineering or traffic interception and reflected as PR:L - with no per-victim credentials, user interaction, or non-default configuration required and the endpoint network-reachable. No KEV entry and no public exploit identified at time of analysis, so real-world urgency is genuinely low, though the integrity impact on account/identity assurance is real anywhere the platform subsequently trusts the registered email for identity, notifications, or recovery.
Non-privileged applications running on a ZTE nubia Z80 Ultra (NX741J) smartphone can retrieve the device's Wi-Fi MAC address by querying the read-only factory_mac_address field exposed through the Android Settings.Secure content database, defeating the platform's normal restriction on hardware MAC address access. The issue is purely local (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N, base score 3.3, C:L/I:N/A:N), requires an attacker-supplied app to already be installed and executing on the handset, and leaks only a single low-sensitivity hardware identifier whose main value is device tracking rather than data compromise. According to available intelligence, no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; deployment is limited to a single consumer handset model, which keeps overall risk low.
Universal cross-site scripting in ZTE's NuBrowser (NebulaOS) allows remote unauthenticated attackers to execute arbitrary JavaScript within the origin of any website visited by the victim. The browser fails to enforce a protocol whitelist on the S.browser_fallback_url parameter of Android's intent:// URI scheme; by serving a 302 redirect pointing to a javascript: URL as the fallback destination, an attacker can trigger script execution under the target page's origin, breaking same-origin protections entirely. No public exploit or KEV listing has been identified at time of analysis, though the fix is pinned to NebulaOS Browser V1.6.8.
SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. No public exploit code or CISA KEV listing has been identified; ZTE classifies this as high-priority and has published a security bulletin.
Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenticated network attacker to extract integrity verification keys and subsequently bypass application integrity checks on the device. Seven specific firmware versions across the V9.0.10 P1, P4, and P6 branches are confirmed affected per the ZTE advisory. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
TLS credential exposure in ZTE ZXHN F680 fiber gateway firmware allows an adjacent-network attacker to extract unencrypted cryptographic key material - classified under CWE-321 (Use of Hard-coded Cryptographic Key) - enabling potential decryption or impersonation of TLS-protected communications between the device and upstream ISP services. Seven discrete firmware versions are confirmed affected per the ENISA EUVD entry and ZTE's own advisory. No public exploit code or CISA KEV listing is confirmed at time of analysis, and the CVSS adjacency requirement and high complexity rating limit realistic exploitation to technically capable actors with local network proximity.
Root password hash exposure in ZTE F689 firmware allows a physical attacker to extract credential material stored in cleartext or weakly protected form within the device firmware image. The F689 is an ISP-deployed broadband gateway, and this vulnerability (CWE-916) means the hash protecting root-level access uses insufficient computational effort, making offline cracking feasible once extracted. No public exploit code has been identified and no active exploitation is confirmed; however, successful hash recovery grants an attacker a path to persistent root-level device compromise.
SQL injection in the ZTE Smart Life mobile app enables a local attacker with physical device access to execute UNION SELECT statements against the app's feedback.db SQLite database, extracting sensitive personal data including user account details, phone numbers, feedback content, and local debug log paths. Exploitation is severely constrained by the CVSS:3.1/AV:P/AC:H/PR:L/UI:R vector, requiring physical access to the device, a low-privilege authenticated session within the app, user interaction, and non-trivial attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor (ZTE PSIRT) has published a bulletin acknowledging the issue.
Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.
Path traversal in ZTE File Manager allows third-party Android apps to read sensitive files under /data/data and /data/local/tmp. The vulnerability is exposed via the FilePreViewActivity which accepts arbitrary file paths from external intents. Exploitation requires a malicious app installed on the device and user installation, but no special privileges; no evidence of active exploitation.
CSRF vulnerability in ZTE ZXUniPOS NDS-LTE enables an attacker to forge authenticated cross-site requests that modify system configuration data on behalf of a high-privilege user. The CVSS vector (PR:H/UI:R/AC:H) tightly constrains exploitation: a high-privilege administrator must be actively tricked into visiting attacker-controlled content while an authenticated session is live. No public exploit code exists and no KEV listing is present; EPSS at 0.02% (4th percentile) and SSVC Exploitation=none collectively signal negligible observed real-world exploitation activity.
Stored cross-site scripting in ZTE ZXUniPOS NDS-LTE enables an authenticated high-privilege attacker to persist malicious JavaScript within the system, which executes automatically in the browsers of other users who access the affected pages. Affected versions include V24.30.40CP02 and V24.40.40 and their respective earlier releases, confirmed via ENISA EUVD-2026-32041 and ZTE's own security bulletin. No public exploit identified at time of analysis, and an EPSS score of 0.03% (9th percentile) reflects a very low automated exploitation probability.
Business logic abuse in ZTE ZXUniPOS NDS-LTE (versions V24.40.40 and V24.30.40CP02) allows a highly privileged authenticated network attacker to manipulate legitimate application functions in ways unintended by the designer, yielding limited integrity and availability degradation. The CVSS score of 3.8 (Low) combined with an EPSS exploitation probability of 0.03% (7th percentile) and SSVC exploitation status of 'none' collectively indicate minimal immediate real-world threat. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Improper permission control on the ZTE MU5250 web management interface allows an adjacent-network attacker with low-level credentials to modify device configuration beyond their authorized scope, resulting in high availability impact and low integrity impact. Affected firmware is confirmed as BD_FLYMODEMMU5250V1.0.0B27, self-disclosed by ZTE via their security bulletin. No public exploit code or CISA KEV listing exists at time of analysis, and exploitation is constrained to adjacent network access with some level of authenticated access per the CVSS vector.
Local denial-of-service vulnerability in ZTE Cloud PC client uSmartview allows authenticated local attackers to trigger memory corruption and crash the application through a use of externally-controlled format string (CWE-134). CVSS 4.7 with local attack vector and high complexity indicates limited real-world exploitability; no public exploit identified at time of analysis.
DLL hijacking in ZTE Cloud PC client uSmartView allows unauthenticated local attackers to achieve arbitrary code execution and privilege escalation by planting a malicious DLL that is loaded by uSmartViewServiceAgent.exe running with SYSTEM privileges. The vulnerability requires local access but no authentication and affects multiple ZXCloud IRAI product versions. No public exploit code or active exploitation has been confirmed at this time.
ZTE Cloud PC client uSmartview contains an OpenSSL configuration file privilege escalation vulnerability (CVE-2026-40004) that allows authenticated local attackers with user-level privileges to execute arbitrary code and escalate to higher privilege levels through a malicious openssl.cnf file. This requires physical access or local system access combined with user interaction, and affects ZTE's virtualized desktop infrastructure product. The CVSS score of 5.5 reflects the physical attack vector and additional user interaction requirement, despite the severity of code execution and cross-system scope impact.
Arbitrary memory writes via USB in ZTE ZX297520V3 BootROM allow physical attackers with USB access to bypass Secure Boot signature verification and achieve unauthorized code execution by exploiting missing target address validation in USB download mode. The vulnerability requires physical device access and user interaction (device boot into download mode), resulting in a CVSS score of 5.1, but enables complete bypass of cryptographic security mechanisms and Secure Boot protections.
Local privilege escalation in ZTE PROCESS Guard Service allows authenticated local users to escalate privileges and achieve arbitrary code execution through improper access control enforcement, affecting the cloud computer client. The vulnerability requires local access and authenticated user context but operates across system boundaries, potentially compromising system integrity. No active exploitation has been confirmed at time of analysis, though the combination of privilege escalation and RCE capability makes this a moderate-priority local threat.
Mf258K Pro Firmware versions up to zte_mf258kpro_play_v1.0.0b03 is affected by improper privilege management (CVSS 4.3).
Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.23.20.04. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service in the ZTE MC889A Pro cellular CPE/hotspot arises from insufficient validation of input parameters handled by the device's Short Message Service (SMS) interface, allowing crafted input to disrupt the affected service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates the flaw is network-reachable with no authentication (PR:N) and no user interaction (UI:N), but the impact is confined to availability only - a service disruption or reboot rather than code execution or data exposure. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and no CISA KEV listing exists, so this is a medium-severity (5.3) issue that is not under known active exploitation; practical exploitation depends on an attacker being able to reach the SMS interface, which on a cellular device typically means knowing the SIM's phone number for over-the-air delivery or having access to the SMS management interface.
Authorization bypass in ZTE's ZXMP M721 optical transport/wavelength-division multiplexing platform allows an attacker holding a valid low-privileged operator account to read the device's communication private key, exposing the cryptographic material that protects management-plane communications and potentially enabling decryption or impersonation of links that rely on that key. Exploitation requires authenticated access to the management interface (CVSS PR:L) and no user interaction, so the practical risk is concentrated in environments where a low-tier credential can be obtained or coerced and the management plane is reachable. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.34% (25th percentile), indicating a low near-term exploit likelihood, though the high confidentiality impact on a network element warrants prompt patching.
Unauthenticated remote code execution affects ZTE's ZXCDN content delivery network product through its Apache Struts-based interface, allowing a network-reachable attacker to run arbitrary commands under the service's non-root account (CVSS 3.1 base 9.8, PR:N/UI:N). Impact is bounded by two practical factors: ZXCDN nodes are typically deployed inside carrier or operator networks rather than on the open internet, and code execution lands with non-root privileges, so full host compromise would require a follow-on local privilege escalation. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, though EPSS sits at roughly 0.80% (55th percentile), reflecting moderate rather than elevated exploitation pressure.
There is an unauthorized access vulnerability in ZTE T5400. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. No vendor patch available.
There is an an information disclosure vulnerability in ZTE T5400. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. No vendor patch available.
There is an unauthorized access vulnerability in ZTE F50. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. No vendor patch available.
There is a code-related vulnerability in the GoldenDB database product. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a DDE injection vulnerability in the GoldenDB database product. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a SQL injection vulnerability in the GoldenDB database product. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an information disclosure vulnerability in the GoldenDB database product. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an information disclosure vulnerability in the GoldenDB database product. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable. No vendor patch available.
The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ZTE NH8091 product has an improper permission control vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a command injection vulnerability in ZTE MF258 Pro product. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The wireless router WRTM326 from SECOM does not properly validate a specific parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.00.10 and earlier. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE). Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. No vendor patch available.
There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity. No vendor patch available.
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro. Rated medium severity (CVSS 6.6). No vendor patch available.
There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Rated medium severity (CVSS 6.4). No vendor patch available.
There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed. Rated medium severity (CVSS 4.4). No vendor patch available.
There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges. Rated medium severity (CVSS 6.7). No vendor patch available.
There is a denial of service vulnerability in some ZTE mobile internet products. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a command injection vulnerability in some ZTE mobile internet products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a SQL injection vulnerability in some ZTE mobile internet products. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
There is a command injection vulnerability in a mobile internet product of ZTE. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a permission and access control vulnerability in some ZTE mobile phones. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Rated high severity (CVSS 7.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ZTE OTCP product is impacted by a permission and access control vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an access control vulnerability in some ZTE PON OLT products. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a buffer overflow vulnerability in ZTE MF286R. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a SQL injection vulnerability in ZTE MF286R. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a SQL injection vulnerability in ZTE ZAIP-AIE. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a broken access control vulnerability in ZTE ZXvSTB product. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZXEN CG200 has a DoS vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.
Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV.
Improper access control in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) lets remote unauthenticated attackers reach functionality that should be permission-gated, allowing them to read and modify system configuration data beyond their authorization. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact but no availability impact, and the issue is tagged as an authentication bypass. EPSS is very low at 0.03% (9th percentile) and there is no public exploit identified at time of analysis.
Information disclosure in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) stems from an insecure cryptographic password scheme - such as hard-coded keys, weak encryption algorithms, or poor key management - that lets remote, unauthenticated attackers recover or tamper with protected data. The CVSS vector (AV:N/AC:H/PR:N) indicates network reachability without credentials but with high attack complexity, and the primary impact is confidentiality loss (C:H) with minor integrity and availability effects. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile).
Unauthorized information disclosure in the ZTE MU5250 mobile broadband modem (firmware BD_FLYMODEMMU5250V1.0.0B27) allows remote attackers to retrieve protected data because an access-control mechanism is improperly configured, exposing information without any authentication. No public exploit identified at time of analysis, and EPSS scores this at just 0.02% (5th percentile), consistent with CISA's SSVC assessment of no observed exploitation and only partial technical impact. Despite a network-reachable, no-authentication CVSS of 7.5, the vendor-reported issue reflects a device-specific misconfiguration rather than a broadly weaponized flaw.
Remote denial-of-service in ZTE home routers (H8102E, H168N, H167A, and 15 other models) allows unauthenticated network attackers to crash the web management interface via oversized HTTP POST request with application/x-www-form-urlencoded content, requiring physical device reboot to restore service. ZTE claims devices patched since March 2021, but operator firmware timelines vary. EPSS data not available; no active exploitation confirmed (not in CISA KEV). Publicly available exploit details exist via GitHub gist.
Remote unauthenticated attackers can retrieve plaintext administrator passwords and WLAN Pre-Shared Keys from ZTE ZXHN H298A (firmware 1.1) and H108N (firmware 2.6) routers via crafted HTTP requests to the web management interface. The vulnerability enables complete network compromise through credential theft without requiring authentication. Public exploit code exists (GitHub Gist), demonstrating active researcher interest, though no CISA KEV listing indicates targeted rather than widespread exploitation. EPSS data unavailable, but the combination of network attack vector, no authentication requirement, and credential exposure presents immediate risk to affected deployments.
Local privilege escalation in the Red Magic 11 Pro (NX809J) gaming smartphone through firmware V1.0.0B14MR1 allows a non-privileged installed application to invoke a sensitive service interface that fails to validate its callers, letting the app write files to specific device partitions and set writable system properties. Reported by ZTE/Nubia through their own support bulletin, the issue is rated CVSS 8.8 with a scope change (S:C) reflecting the crossing of the app-sandbox privilege boundary into system context. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.
Password reset vulnerability in ZTE ZXEDM iEMS cloud management portal allows authenticated attackers with low privileges to enumerate all user accounts and reset arbitrary user passwords. This authentication bypass enables unauthorized administrative operations across the entire EMS system. Attack requires user interaction and moderate complexity (CVSS AC:H), but no public exploit identified at time of analysis. CVSS 7.1 reflects high confidentiality, integrity, and availability impact within the vulnerable component's scope.
Unauthenticated credential disclosure in ZTE ZXHN H188A routers (versions V6.0.10P2_TE and V6.0.10P3N3_TE) allows local network attackers to retrieve sensitive credentials including default administrator passwords, WLAN PSK, and PPPoE credentials via the wizard interface, with some cases enabling unauthenticated configuration changes. No CVSS or EPSS data is available, and KEV status is unconfirmed; however, a publicly available technical analysis exists on GitHub indicating detailed exploitation methodology.
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to invoke system interfaces through reflection and retrieve sensitive information, because those interfaces lack robust invocation authentication and access control. Exploitation is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), with confidentiality impact only and no integrity or availability effect. No public exploit identified at time of analysis; the issue is classified under CWE-269 and tagged as privilege escalation, but the assessed impact is a moderate, local-only information-disclosure flaw rather than a high-priority remote threat.
Local information disclosure in ZTE Z80 Ultra devices allows an installed third-party application to capture device-related data returned by system interfaces that do not adequately restrict access. The issue requires local execution and user interaction to install or run the hostile app, and it needs no elevated privileges (PR:N), resulting in a low CVSS score of 3.3 with only confidentiality impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is best treated as low priority.
Information disclosure in ZTE Z80 Ultra allows a locally installed application to read device-related information by invoking framework methods that have insufficient access control. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) means an attacker needs local access and must persuade or trick the user into installing or interacting with a malicious app, with impact limited to confidentiality; there is no integrity or availability impact and no privilege gain, despite the 'Privilege Escalation' tag. No public exploit code is identified at time of analysis, and the issue is assessed as moderate and locally scoped.
Information disclosure in ZTE Z80 Ultra devices lets a locally installed malicious application read information through system callable functions that lack sufficient access control. This is a low-severity, low-priority local issue (CVSS 3.3) requiring user interaction, typically installing or launching the attacker's app, with only confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis.
ZTE Z80 Ultra allows a malicious third-party application installed on the device to hook exposed system APIs and read limited sensitive information, resulting in a low-severity information disclosure (CVSS 3.1 base score 3.3). The attack is local-only, requires user interaction to install the attacking app, and requires no special privileges (PR:N), with only a low confidentiality impact and no integrity or availability impact; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Information disclosure in ZTE Z80 Ultra (nubia Z80 Ultra) smartphones allows a local app to reflectively invoke a system interface that lacks the necessary access-control check and read otherwise-protected information, with no integrity or availability impact. The vendor rates this CVE-2026-108501 at CVSS 5.7 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), while the independent assessment treats it as a local, unauthenticated information-disclosure issue (CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) that requires code execution on the device via an attacker-controlled app. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is confined to the ZTE Z80 Ultra model.
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.
The ZTE SmartLife client application ships with a hardcoded cryptographic key stored in plaintext within its code, allowing anyone who obtains and reverse-engineers the app package to recover the key and decrypt the embedded account-server information. Exploitation is local in nature - the attacker must first acquire the application binary and perform static analysis - and what is exposed is backend account-server configuration data rather than per-user credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor scores this 6.2 with high confidentiality impact, while independent assessment rates confidentiality impact as Low, framing this as a defense-in-depth weakness rather than an urgent, remotely-weaponizable flaw.
Information disclosure in ZTE SmartLife allows an attacker who can extract the app's runtime-generated application authentication parameters to query the backend /account/verify.serv endpoint, confirm whether a target email address is registered, and retrieve the corresponding real backend account ID. The independent assessment treats the issue as network-reachable and unauthenticated from the backend's perspective because those parameters are obtainable by running or reverse-engineering the SmartLife client, though the practical impact is limited to email enumeration and account-ID leakage in ZTE's SmartLife ecosystem, not a full privilege escalation. No CISA KEV entry and no public exploit were identified at time of analysis.
ZTE SmartLife's backend signup interface (/account/person/signup.serv) creates accounts for arbitrary email addresses without verifying that the requester owns the address, so an attacker who has extracted the app's runtime-generated authentication parameters can complete registration against any email string. The assigned vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) and our independent assessment agree on moderate severity: the primary barrier is first obtaining the client-generated app authentication parameters - obtainable via reverse engineering or traffic interception and reflected as PR:L - with no per-victim credentials, user interaction, or non-default configuration required and the endpoint network-reachable. No KEV entry and no public exploit identified at time of analysis, so real-world urgency is genuinely low, though the integrity impact on account/identity assurance is real anywhere the platform subsequently trusts the registered email for identity, notifications, or recovery.
Non-privileged applications running on a ZTE nubia Z80 Ultra (NX741J) smartphone can retrieve the device's Wi-Fi MAC address by querying the read-only factory_mac_address field exposed through the Android Settings.Secure content database, defeating the platform's normal restriction on hardware MAC address access. The issue is purely local (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N, base score 3.3, C:L/I:N/A:N), requires an attacker-supplied app to already be installed and executing on the handset, and leaks only a single low-sensitivity hardware identifier whose main value is device tracking rather than data compromise. According to available intelligence, no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; deployment is limited to a single consumer handset model, which keeps overall risk low.
Universal cross-site scripting in ZTE's NuBrowser (NebulaOS) allows remote unauthenticated attackers to execute arbitrary JavaScript within the origin of any website visited by the victim. The browser fails to enforce a protocol whitelist on the S.browser_fallback_url parameter of Android's intent:// URI scheme; by serving a 302 redirect pointing to a javascript: URL as the fallback destination, an attacker can trigger script execution under the target page's origin, breaking same-origin protections entirely. No public exploit or KEV listing has been identified at time of analysis, though the fix is pinned to NebulaOS Browser V1.6.8.
SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. No public exploit code or CISA KEV listing has been identified; ZTE classifies this as high-priority and has published a security bulletin.
Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenticated network attacker to extract integrity verification keys and subsequently bypass application integrity checks on the device. Seven specific firmware versions across the V9.0.10 P1, P4, and P6 branches are confirmed affected per the ZTE advisory. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
TLS credential exposure in ZTE ZXHN F680 fiber gateway firmware allows an adjacent-network attacker to extract unencrypted cryptographic key material - classified under CWE-321 (Use of Hard-coded Cryptographic Key) - enabling potential decryption or impersonation of TLS-protected communications between the device and upstream ISP services. Seven discrete firmware versions are confirmed affected per the ENISA EUVD entry and ZTE's own advisory. No public exploit code or CISA KEV listing is confirmed at time of analysis, and the CVSS adjacency requirement and high complexity rating limit realistic exploitation to technically capable actors with local network proximity.
Root password hash exposure in ZTE F689 firmware allows a physical attacker to extract credential material stored in cleartext or weakly protected form within the device firmware image. The F689 is an ISP-deployed broadband gateway, and this vulnerability (CWE-916) means the hash protecting root-level access uses insufficient computational effort, making offline cracking feasible once extracted. No public exploit code has been identified and no active exploitation is confirmed; however, successful hash recovery grants an attacker a path to persistent root-level device compromise.
SQL injection in the ZTE Smart Life mobile app enables a local attacker with physical device access to execute UNION SELECT statements against the app's feedback.db SQLite database, extracting sensitive personal data including user account details, phone numbers, feedback content, and local debug log paths. Exploitation is severely constrained by the CVSS:3.1/AV:P/AC:H/PR:L/UI:R vector, requiring physical access to the device, a low-privilege authenticated session within the app, user interaction, and non-trivial attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor (ZTE PSIRT) has published a bulletin acknowledging the issue.
Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.
Path traversal in ZTE File Manager allows third-party Android apps to read sensitive files under /data/data and /data/local/tmp. The vulnerability is exposed via the FilePreViewActivity which accepts arbitrary file paths from external intents. Exploitation requires a malicious app installed on the device and user installation, but no special privileges; no evidence of active exploitation.
CSRF vulnerability in ZTE ZXUniPOS NDS-LTE enables an attacker to forge authenticated cross-site requests that modify system configuration data on behalf of a high-privilege user. The CVSS vector (PR:H/UI:R/AC:H) tightly constrains exploitation: a high-privilege administrator must be actively tricked into visiting attacker-controlled content while an authenticated session is live. No public exploit code exists and no KEV listing is present; EPSS at 0.02% (4th percentile) and SSVC Exploitation=none collectively signal negligible observed real-world exploitation activity.
Stored cross-site scripting in ZTE ZXUniPOS NDS-LTE enables an authenticated high-privilege attacker to persist malicious JavaScript within the system, which executes automatically in the browsers of other users who access the affected pages. Affected versions include V24.30.40CP02 and V24.40.40 and their respective earlier releases, confirmed via ENISA EUVD-2026-32041 and ZTE's own security bulletin. No public exploit identified at time of analysis, and an EPSS score of 0.03% (9th percentile) reflects a very low automated exploitation probability.
Business logic abuse in ZTE ZXUniPOS NDS-LTE (versions V24.40.40 and V24.30.40CP02) allows a highly privileged authenticated network attacker to manipulate legitimate application functions in ways unintended by the designer, yielding limited integrity and availability degradation. The CVSS score of 3.8 (Low) combined with an EPSS exploitation probability of 0.03% (7th percentile) and SSVC exploitation status of 'none' collectively indicate minimal immediate real-world threat. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Improper permission control on the ZTE MU5250 web management interface allows an adjacent-network attacker with low-level credentials to modify device configuration beyond their authorized scope, resulting in high availability impact and low integrity impact. Affected firmware is confirmed as BD_FLYMODEMMU5250V1.0.0B27, self-disclosed by ZTE via their security bulletin. No public exploit code or CISA KEV listing exists at time of analysis, and exploitation is constrained to adjacent network access with some level of authenticated access per the CVSS vector.
Local denial-of-service vulnerability in ZTE Cloud PC client uSmartview allows authenticated local attackers to trigger memory corruption and crash the application through a use of externally-controlled format string (CWE-134). CVSS 4.7 with local attack vector and high complexity indicates limited real-world exploitability; no public exploit identified at time of analysis.
DLL hijacking in ZTE Cloud PC client uSmartView allows unauthenticated local attackers to achieve arbitrary code execution and privilege escalation by planting a malicious DLL that is loaded by uSmartViewServiceAgent.exe running with SYSTEM privileges. The vulnerability requires local access but no authentication and affects multiple ZXCloud IRAI product versions. No public exploit code or active exploitation has been confirmed at this time.
ZTE Cloud PC client uSmartview contains an OpenSSL configuration file privilege escalation vulnerability (CVE-2026-40004) that allows authenticated local attackers with user-level privileges to execute arbitrary code and escalate to higher privilege levels through a malicious openssl.cnf file. This requires physical access or local system access combined with user interaction, and affects ZTE's virtualized desktop infrastructure product. The CVSS score of 5.5 reflects the physical attack vector and additional user interaction requirement, despite the severity of code execution and cross-system scope impact.
Arbitrary memory writes via USB in ZTE ZX297520V3 BootROM allow physical attackers with USB access to bypass Secure Boot signature verification and achieve unauthorized code execution by exploiting missing target address validation in USB download mode. The vulnerability requires physical device access and user interaction (device boot into download mode), resulting in a CVSS score of 5.1, but enables complete bypass of cryptographic security mechanisms and Secure Boot protections.
Local privilege escalation in ZTE PROCESS Guard Service allows authenticated local users to escalate privileges and achieve arbitrary code execution through improper access control enforcement, affecting the cloud computer client. The vulnerability requires local access and authenticated user context but operates across system boundaries, potentially compromising system integrity. No active exploitation has been confirmed at time of analysis, though the combination of privilege escalation and RCE capability makes this a moderate-priority local threat.
Mf258K Pro Firmware versions up to zte_mf258kpro_play_v1.0.0b03 is affected by improper privilege management (CVSS 4.3).
Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.23.20.04. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service in the ZTE MC889A Pro cellular CPE/hotspot arises from insufficient validation of input parameters handled by the device's Short Message Service (SMS) interface, allowing crafted input to disrupt the affected service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates the flaw is network-reachable with no authentication (PR:N) and no user interaction (UI:N), but the impact is confined to availability only - a service disruption or reboot rather than code execution or data exposure. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and no CISA KEV listing exists, so this is a medium-severity (5.3) issue that is not under known active exploitation; practical exploitation depends on an attacker being able to reach the SMS interface, which on a cellular device typically means knowing the SIM's phone number for over-the-air delivery or having access to the SMS management interface.
Authorization bypass in ZTE's ZXMP M721 optical transport/wavelength-division multiplexing platform allows an attacker holding a valid low-privileged operator account to read the device's communication private key, exposing the cryptographic material that protects management-plane communications and potentially enabling decryption or impersonation of links that rely on that key. Exploitation requires authenticated access to the management interface (CVSS PR:L) and no user interaction, so the practical risk is concentrated in environments where a low-tier credential can be obtained or coerced and the management plane is reachable. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.34% (25th percentile), indicating a low near-term exploit likelihood, though the high confidentiality impact on a network element warrants prompt patching.
Unauthenticated remote code execution affects ZTE's ZXCDN content delivery network product through its Apache Struts-based interface, allowing a network-reachable attacker to run arbitrary commands under the service's non-root account (CVSS 3.1 base 9.8, PR:N/UI:N). Impact is bounded by two practical factors: ZXCDN nodes are typically deployed inside carrier or operator networks rather than on the open internet, and code execution lands with non-root privileges, so full host compromise would require a follow-on local privilege escalation. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, though EPSS sits at roughly 0.80% (55th percentile), reflecting moderate rather than elevated exploitation pressure.
There is an unauthorized access vulnerability in ZTE T5400. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. No vendor patch available.
There is an an information disclosure vulnerability in ZTE T5400. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. No vendor patch available.
There is an unauthorized access vulnerability in ZTE F50. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. No vendor patch available.
There is a code-related vulnerability in the GoldenDB database product. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a DDE injection vulnerability in the GoldenDB database product. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a SQL injection vulnerability in the GoldenDB database product. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an information disclosure vulnerability in the GoldenDB database product. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an information disclosure vulnerability in the GoldenDB database product. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable. No vendor patch available.
The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ZTE NH8091 product has an improper permission control vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a command injection vulnerability in ZTE MF258 Pro product. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The wireless router WRTM326 from SECOM does not properly validate a specific parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.00.10 and earlier. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE). Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. No vendor patch available.
There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity. No vendor patch available.
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro. Rated medium severity (CVSS 6.6). No vendor patch available.
There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Rated medium severity (CVSS 6.4). No vendor patch available.
There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed. Rated medium severity (CVSS 4.4). No vendor patch available.
There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges. Rated medium severity (CVSS 6.7). No vendor patch available.
There is a denial of service vulnerability in some ZTE mobile internet products. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a command injection vulnerability in some ZTE mobile internet products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a SQL injection vulnerability in some ZTE mobile internet products. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
There is a command injection vulnerability in a mobile internet product of ZTE. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a permission and access control vulnerability in some ZTE mobile phones. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Rated high severity (CVSS 7.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ZTE OTCP product is impacted by a permission and access control vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an access control vulnerability in some ZTE PON OLT products. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a buffer overflow vulnerability in ZTE MF286R. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a SQL injection vulnerability in ZTE MF286R. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a SQL injection vulnerability in ZTE ZAIP-AIE. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a broken access control vulnerability in ZTE ZXvSTB product. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZXEN CG200 has a DoS vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.