This vulnerability (CVE-2026-40004) in ZTE ZXCLOUD iRAI client version 7.2X is classified as CWE-427 (Uncontrolled Search Path Element). It involves a privilege escalation issue caused by the insecure handling of the openssl.cnf file, which can be manipulated by an attacker with local access to execute arbitrary code with escalated privileges. The CVSS 3.1 base score is 5.5, reflecting medium severity, with attack vector as physical/local, high attack complexity, and requiring user interaction. The vulnerability impacts confidentiality highly, integrity to a lesser extent, and does not affect availability.

An attacker with local access and limited privileges can exploit this vulnerability to execute arbitrary code and escalate their privileges on the affected system. This could lead to unauthorized access to sensitive information or system components. However, the attack complexity is high, and user interaction is required, which limits the ease of exploitation. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor ZTE's advisories for updates. Until a patch is released, restricting local access to trusted users and minimizing the need for user interaction with untrusted files may reduce risk.