This vulnerability (CWE-427) in ZTE ZXCLOUD iRAI Client version 7.2X arises from an uncontrolled search path element in the openssl.cnf configuration file. An attacker with local access and limited privileges can exploit this to execute arbitrary code and escalate privileges. The CVSS 3.1 base score is 5.5, reflecting medium severity, with attack vector as physical or local, high attack complexity, and requiring user interaction. The vulnerability impacts confidentiality significantly, with limited integrity impact and no availability impact. No known exploits are reported in the wild, and no official remediation or patch has been disclosed by ZTE as of the publication date.

Successful exploitation allows local attackers to execute arbitrary code and escalate privileges on the affected ZTE ZXCLOUD iRAI client system. This can lead to unauthorized access to sensitive information (high confidentiality impact) and partial integrity compromise. There is no reported impact on system availability. The attack requires local access and user interaction, limiting remote exploitation possibilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to trusted users only and monitor for suspicious local activity. Avoid running untrusted code or opening untrusted files on affected systems. Follow ZTE's official channels for updates regarding patches or mitigations.