CVE-2025-46582: ZTE ZXMP M721 · Use of Hard-coded Cryptographic Key
Affects ZTE ZXMP M721Source CVE Database V5
Not known to be exploited · CVSS 7.7 High.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
1. Apply firmware updates or patches from ZTE as soon as they become available to remove or replace the hard-coded cryptographic key. 2. If patches are not yet available, isolate affected ZXMP M721 devices within segmented network zones with strict access controls to limit exposure. 3. Implement strong network monitoring and anomaly detection to identify unauthorized access attempts or unusual key usage patterns. 4. Enforce multi-factor authentication and role-based access controls on device management interfaces to prevent low-privileged users from accessing sensitive functions. 5. Conduct regular security audits and penetration testing focused on cryptographic key management and device authorization mechanisms. 6. Coordinate with ZTE and telecom vendors to verify device configurations and ensure no default or hard-coded keys remain in use. 7. Develop incident response plans specifically addressing cryptographic key compromise scenarios to enable rapid containment and recovery. 8. Consider deploying additional encryption layers at higher network levels to mitigate risks if device-level keys are compromised.
Description
A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security.