30
CVEs
2
Critical
8
High
0
KEV
6
PoC
10
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
8
MEDIUM
15
LOW
5
Monthly CVE Trend
Affected Products (30)
Zxcloud Irai
10
Zxv10 W300 Firmware
7
Zxhn F670 Firmware
7
Mf971R Firmware
7
Zxcloud Goldendb
7
Zxhn H108N R1A Firmware
6
Zxv10 W300
5
Zxhn H168N Firmware
5
Zxr10 160 Firmware
4
Mf286R Firmware
4
Zxr10 1800 2S Firmware
4
Zxunipos Nds Lte
4
Zxdsl
4
Zxr10 3800 8 Firmware
4
Zxr10 2800 4 Firmware
4
Mc801A1 Firmware
3
Zte Zmax Champ Firmware
3
Zxcloud Goldendata Vap
3
N A
3
Mc801A Firmware
3
F689
3
Zxhn H108N Firmware
3
Zxv10 B860A Firmware
2
Otcp Firmware
2
Zxupn 9000E Firmware
2
R8500G4 Firmware
2
R5500G4 Firmware
2
Wf820 Lte Outdoor Cpe Firmware
2
Zxhn E8810 Firmware
2
R5300G4 Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-34473 | Remote denial-of-service in ZTE home routers (H8102E, H168N, H167A, and 15 other models) allows unauthenticated network attackers to crash the web management interface via oversized HTTP POST request with application/x-www-form-urlencoded content, requiring physical device reboot to restore service. ZTE claims devices patched since March 2021, but operator firmware timelines vary. EPSS data not available; no active exploitation confirmed (not in CISA KEV). Publicly available exploit details exist via GitHub gist. | HIGH | 7.5 | 0.0% | 58 |
PoC
No patch
|
| CVE-2026-34474 | Remote unauthenticated attackers can retrieve plaintext administrator passwords and WLAN Pre-Shared Keys from ZTE ZXHN H298A (firmware 1.1) and H108N (firmware 2.6) routers via crafted HTTP requests to the web management interface. The vulnerability enables complete network compromise through credential theft without requiring authentication. Public exploit code exists (GitHub Gist), demonstrating active researcher interest, though no CISA KEV listing indicates targeted rather than widespread exploitation. EPSS data unavailable, but the combination of network attack vector, no authentication requirement, and credential exposure presents immediate risk to affected deployments. | HIGH | 7.5 | 0.0% | 58 |
PoC
No patch
|
| CVE-2026-34472 | Unauthenticated credential disclosure in ZTE ZXHN H188A routers (versions V6.0.10P2_TE and V6.0.10P3N3_TE) allows local network attackers to retrieve sensitive credentials including default administrator passwords, WLAN PSK, and PPPoE credentials via the wizard interface, with some cases enabling unauthenticated configuration changes. No CVSS or EPSS data is available, and KEV status is unconfirmed; however, a publicly available technical analysis exists on GitHub indicating detailed exploitation methodology. | HIGH | 7.1 | 0.0% | 56 |
PoC
No patch
|
| CVE-2026-49008 | Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenticated network attacker to extract integrity verification keys and subsequently bypass application integrity checks on the device. Seven specific firmware versions across the V9.0.10 P1, P4, and P6 branches are confirmed affected per the ZTE advisory. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
No patch
|
| CVE-2026-49003 | Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV. | CRITICAL | 9.6 | 2.4% | 50 |
No patch
|
| CVE-2026-49006 | TLS credential exposure in ZTE ZXHN F680 fiber gateway firmware allows an adjacent-network attacker to extract unencrypted cryptographic key material - classified under CWE-321 (Use of Hard-coded Cryptographic Key) - enabling potential decryption or impersonation of TLS-protected communications between the device and upstream ISP services. Seven discrete firmware versions are confirmed affected per the ENISA EUVD entry and ZTE's own advisory. No public exploit code or CISA KEV listing is confirmed at time of analysis, and the CVSS adjacency requirement and high complexity rating limit realistic exploitation to technically capable actors with local network proximity. | MEDIUM | 5.3 | 0.1% | 47 |
PoC
No patch
|
| CVE-2026-49002 | Improper access control in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) lets remote unauthenticated attackers reach functionality that should be permission-gated, allowing them to read and modify system configuration data beyond their authorization. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact but no availability impact, and the issue is tagged as an authentication bypass. EPSS is very low at 0.03% (9th percentile) and there is no public exploit identified at time of analysis. | CRITICAL | 9.1 | 0.0% | 46 |
No patch
|
| CVE-2026-40002 | Local privilege escalation in the Red Magic 11 Pro (NX809J) gaming smartphone through firmware V1.0.0B14MR1 allows a non-privileged installed application to invoke a sensitive service interface that fails to validate its callers, letting the app write files to specific device partitions and set writable system properties. Reported by ZTE/Nubia through their own support bulletin, the issue is rated CVSS 8.8 with a scope change (S:C) reflecting the crossing of the app-sandbox privilege boundary into system context. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-44409 | Unauthorized information disclosure in the ZTE MU5250 mobile broadband modem (firmware BD_FLYMODEMMU5250V1.0.0B27) allows remote attackers to retrieve protected data because an access-control mechanism is improperly configured, exposing information without any authentication. No public exploit identified at time of analysis, and EPSS scores this at just 0.02% (5th percentile), consistent with CISA's SSVC assessment of no observed exploitation and only partial technical impact. Despite a network-reachable, no-authentication CVSS of 7.5, the vendor-reported issue reflects a device-specific misconfiguration rather than a broadly weaponized flaw. | HIGH | 7.5 | 0.0% | 38 |
No patch
|
| CVE-2025-66314 | Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.23.20.04. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 7.5 | 0.0% | 38 |
No patch
|
| CVE-2026-40436 | Password reset vulnerability in ZTE ZXEDM iEMS cloud management portal allows authenticated attackers with low privileges to enumerate all user accounts and reset arbitrary user passwords. This authentication bypass enables unauthorized administrative operations across the entire EMS system. Attack requires user interaction and moderate complexity (CVSS AC:H), but no public exploit identified at time of analysis. CVSS 7.1 reflects high confidentiality, integrity, and availability impact within the vulnerable component's scope. | HIGH | 7.1 | 0.0% | 36 |
No patch
|
| CVE-2026-49000 | Information disclosure in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) stems from an insecure cryptographic password scheme - such as hard-coded keys, weak encryption algorithms, or poor key management - that lets remote, unauthenticated attackers recover or tamper with protected data. The CVSS vector (AV:N/AC:H/PR:N) indicates network reachability without credentials but with high attack complexity, and the primary impact is confidentiality loss (C:H) with minor integrity and availability effects. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile). | HIGH | 7.0 | 0.0% | 35 |
No patch
|
| CVE-2026-49004 | Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible. | MEDIUM | 6.5 | 0.7% | 33 |
No patch
|
| CVE-2026-86550 | Universal cross-site scripting in ZTE's NuBrowser (NebulaOS) allows remote unauthenticated attackers to execute arbitrary JavaScript within the origin of any website visited by the victim. The browser fails to enforce a protocol whitelist on the S.browser_fallback_url parameter of Android's intent:// URI scheme; by serving a 302 redirect pointing to a javascript: URL as the fallback destination, an attacker can trigger script execution under the target page's origin, breaking same-origin protections entirely. No public exploit or KEV listing has been identified at time of analysis, though the fix is pinned to NebulaOS Browser V1.6.8. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-49005 | Root password hash exposure in ZTE F689 firmware allows a physical attacker to extract credential material stored in cleartext or weakly protected form within the device firmware image. The F689 is an ISP-deployed broadband gateway, and this vulnerability (CWE-916) means the hash protecting root-level access uses insufficient computational effort, making offline cracking feasible once extracted. No public exploit code has been identified and no active exploitation is confirmed; however, successful hash recovery grants an attacker a path to persistent root-level device compromise. | LOW | 2.4 | 0.1% | 32 |
PoC
No patch
|