3
CVEs
1
Critical
0
High
0
KEV
0
PoC
1
Unpatched C/H
0.0%
Patch Rate
1.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Zxcloud Irai
10
Zxv10 W300 Firmware
7
Zxhn F670 Firmware
7
Mf971R Firmware
7
Zxcloud Goldendb
7
Zxhn H108N R1A Firmware
6
Zxv10 W300
5
Zxhn H168N Firmware
5
Zxr10 160 Firmware
4
Mf286R Firmware
4
Zxr10 1800 2S Firmware
4
Zxunipos Nds Lte
4
Zxdsl
4
Zxr10 3800 8 Firmware
4
Zxr10 2800 4 Firmware
4
Mc801A1 Firmware
3
Zte Zmax Champ Firmware
3
Zxcloud Goldendata Vap
3
N A
3
Mc801A Firmware
3
F689
3
Zxhn H108N Firmware
3
Zxv10 B860A Firmware
2
Otcp Firmware
2
Zxupn 9000E Firmware
2
R8500G4 Firmware
2
R5500G4 Firmware
2
Wf820 Lte Outdoor Cpe Firmware
2
Zxhn E8810 Firmware
2
R5300G4 Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-49003 | Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV. | CRITICAL | 9.6 | 2.4% | 50 |
No patch
|
| CVE-2026-86550 | Universal cross-site scripting in ZTE's NuBrowser (NebulaOS) allows remote unauthenticated attackers to execute arbitrary JavaScript within the origin of any website visited by the victim. The browser fails to enforce a protocol whitelist on the S.browser_fallback_url parameter of Android's intent:// URI scheme; by serving a 302 redirect pointing to a javascript: URL as the fallback destination, an attacker can trigger script execution under the target page's origin, breaking same-origin protections entirely. No public exploit or KEV listing has been identified at time of analysis, though the fix is pinned to NebulaOS Browser V1.6.8. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-9668 | SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. No public exploit code or CISA KEV listing has been identified; ZTE classifies this as high-priority and has published a security bulletin. | MEDIUM | 6.3 | 0.6% | 32 |
No patch
|