9
CVEs
1
Critical
0
High
0
KEV
3
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
5
LOW
3
Monthly CVE Trend
Affected Products (30)
Zxcloud Irai
10
Zxv10 W300 Firmware
7
Zxhn F670 Firmware
7
Mf971R Firmware
7
Zxcloud Goldendb
7
Zxhn H108N R1A Firmware
6
Zxv10 W300
5
Zxhn H168N Firmware
5
Zxr10 160 Firmware
4
Mf286R Firmware
4
Zxr10 1800 2S Firmware
4
Zxunipos Nds Lte
4
Zxdsl
4
Zxr10 3800 8 Firmware
4
Zxr10 2800 4 Firmware
4
Mc801A1 Firmware
3
Zte Zmax Champ Firmware
3
Zxcloud Goldendata Vap
3
N A
3
Mc801A Firmware
3
F689
3
Zxhn H108N Firmware
3
Zxv10 B860A Firmware
2
Otcp Firmware
2
Zxupn 9000E Firmware
2
R8500G4 Firmware
2
R5500G4 Firmware
2
Wf820 Lte Outdoor Cpe Firmware
2
Zxhn E8810 Firmware
2
R5300G4 Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-49008 | Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenticated network attacker to extract integrity verification keys and subsequently bypass application integrity checks on the device. Seven specific firmware versions across the V9.0.10 P1, P4, and P6 branches are confirmed affected per the ZTE advisory. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
No patch
|
| CVE-2026-49003 | Command injection reachable via authentication bypass in ZTE ZXDU68 S202 V5.0, a telecom DC power supply monitoring system, lets adjacent-network attackers gain root and delete core runtime files-crashing the monitoring module-while stealing stored credentials such as SNMP community strings. Rated CVSS 9.6 with scope change, exploitation allows tampering with critical power-system parameters and can drive the entire power plant into abnormal operation. No public exploit is identified at time of analysis and it is not in CISA KEV. | CRITICAL | 9.6 | 2.4% | 50 |
No patch
|
| CVE-2026-49006 | TLS credential exposure in ZTE ZXHN F680 fiber gateway firmware allows an adjacent-network attacker to extract unencrypted cryptographic key material - classified under CWE-321 (Use of Hard-coded Cryptographic Key) - enabling potential decryption or impersonation of TLS-protected communications between the device and upstream ISP services. Seven discrete firmware versions are confirmed affected per the ENISA EUVD entry and ZTE's own advisory. No public exploit code or CISA KEV listing is confirmed at time of analysis, and the CVSS adjacency requirement and high complexity rating limit realistic exploitation to technically capable actors with local network proximity. | MEDIUM | 5.3 | 0.1% | 47 |
PoC
No patch
|
| CVE-2026-49004 | Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible. | MEDIUM | 6.5 | 0.7% | 33 |
No patch
|
| CVE-2026-86550 | Universal cross-site scripting in ZTE's NuBrowser (NebulaOS) allows remote unauthenticated attackers to execute arbitrary JavaScript within the origin of any website visited by the victim. The browser fails to enforce a protocol whitelist on the S.browser_fallback_url parameter of Android's intent:// URI scheme; by serving a 302 redirect pointing to a javascript: URL as the fallback destination, an attacker can trigger script execution under the target page's origin, breaking same-origin protections entirely. No public exploit or KEV listing has been identified at time of analysis, though the fix is pinned to NebulaOS Browser V1.6.8. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-49005 | Root password hash exposure in ZTE F689 firmware allows a physical attacker to extract credential material stored in cleartext or weakly protected form within the device firmware image. The F689 is an ISP-deployed broadband gateway, and this vulnerability (CWE-916) means the hash protecting root-level access uses insufficient computational effort, making offline cracking feasible once extracted. No public exploit code has been identified and no active exploitation is confirmed; however, successful hash recovery grants an attacker a path to persistent root-level device compromise. | LOW | 2.4 | 0.1% | 32 |
PoC
No patch
|
| CVE-2026-9668 | SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. No public exploit code or CISA KEV listing has been identified; ZTE classifies this as high-priority and has published a security bulletin. | MEDIUM | 6.3 | 0.6% | 32 |
No patch
|
| CVE-2026-8029 | SQL injection in the ZTE Smart Life mobile app enables a local attacker with physical device access to execute UNION SELECT statements against the app's feedback.db SQLite database, extracting sensitive personal data including user account details, phone numbers, feedback content, and local debug log paths. Exploitation is severely constrained by the CVSS:3.1/AV:P/AC:H/PR:L/UI:R vector, requiring physical access to the device, a low-privilege authenticated session within the app, user interaction, and non-trivial attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor (ZTE PSIRT) has published a bulletin acknowledging the issue. | LOW | 3.9 | 0.1% | 20 |
No patch
|
| CVE-2026-40000 | Path traversal in ZTE File Manager allows third-party Android apps to read sensitive files under /data/data and /data/local/tmp. The vulnerability is exposed via the FilePreViewActivity which accepts arbitrary file paths from external intents. Exploitation requires a malicious app installed on the device and user installation, but no special privileges; no evidence of active exploitation. | LOW | 1.8 | 0.3% | 9 |
No patch
|