Threat database

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with the privilege level of ZTE File Manager. This allows unrooted devices to read files under certain system directories such as /data/data and /data/local/tmp. If access restrictions do not block untrusted applications, additional directories may also be accessible.

CVE-2026-11466 is a medium severity vulnerability in zilliztech deep-searcher versions 0.0.1 and 0.0.2. It involves improper access controls in the CollectionRouter.invoke function, allowing remote attackers to manipulate arguments and potentially bypass access restrictions. A fix has been proposed but is not yet accepted or released. No known exploits are currently in the wild.

CVE-2026-10812 is a low-severity vulnerability in zilliztech GPTCache up to version 0.1.44. It involves the use of a weak hash function in the BufferedReader.peek function within the Cache Key Handler component. Exploitation requires local access and is considered highly complex and difficult. A fix has been proposed but is not yet accepted or officially released.

ZTE H298A / H108N - Unauthenticated Credential Exposure

ZTE ZXHN H188A V6 - Authentication Bypass

ZTE Routers - Unauthenticated Denial of Service

CVE-2026-49002 is a critical improper access control vulnerability in ZTE ZXUniPOS NDS-LTE that allows unauthorized users to access and potentially modify system configuration data beyond their permissions. The vulnerability affects versions earlier than V24.40.40CP01, excluding V24.30.40CP03 and V24.40.40CP01. It has a CVSS score of 9.1, indicating high impact on confidentiality and integrity without requiring privileges or user interaction.

CVE-2026-49001 is a medium severity cross-site request forgery (CSRF) vulnerability affecting ZTE ZXUniPOS NDS-LTE versions prior to V24.40.40CP01, excluding V24.30.40CP03 and V24.40.40CP01. This vulnerability allows attackers to exploit authenticated user sessions to perform unauthorized operations, such as tampering with configuration data. The vulnerability requires high privileges and user interaction, and the attack complexity is high. There is no official patch or remediation information provided by the vendor at this time.

CVE-2026-49000 is a high-severity vulnerability in ZTE ZXUniPOS NDS-LTE affecting versions prior to V24.40.40CP01 (excluding V24.30.40CP03 and V24.40.40CP01). It involves an insecure password scheme due to improper cryptographic practices such as weak encryption algorithms, poor key management, or hard-coded keys. This weakness can lead to data leakage or tampering. There is no official patch or remediation guidance currently available from the vendor.

CVE-2026-48999 is a cross-site scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE affecting versions prior to V24.40.40CP01 except V24.30.40CP03 and V24.40.40CP01. It allows attackers to inject malicious scripts that execute in users' browsers, potentially leading to cookie theft, session hijacking, and content tampering. The vulnerability is classified as medium severity with a CVSS score of 5.7.

This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks.

There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.

There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can  modify configuration through the interface.

CVE-2026-44407 is a medium severity vulnerability in the ZTE ZXCLOUD iRAI client (version 7.2X) involving an externally-controlled format string issue (CWE-134). This flaw can cause memory corruption leading to a remote denial-of-service condition. The vulnerability requires local access with low privileges and high attack complexity, with no user interaction needed. No official patch or remediation guidance has been provided by the vendor at this time, and no known exploits are reported in the wild.

ZTE ZXCLOUD iRAI's Cloud PC client uSmartView contains a DLL hijacking vulnerability (CWE-427). The vulnerable process, uSmartViewServiceAgent.exe, runs with SYSTEM privileges, allowing a local attacker to execute arbitrary code, escalate privileges, and potentially cause memory corruption. The vulnerability affects version ZXCLOUD-iRAI-ClientV7.2X. The CVSS 3.1 base score is 5.7 (medium severity). No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-40004 is a medium severity vulnerability in the ZTE ZXCLOUD iRAI client (version ZXCLOUD-iRAI-ClientV7.2X) involving an uncontrolled search path element related to openssl.cnf. This flaw allows a local attacker to execute arbitrary code and escalate privileges by exploiting the improper handling of the OpenSSL configuration file. The vulnerability requires local access and user interaction, with a high attack complexity and limited privileges initially. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.

There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass.

CVE-2026-40002 is a medium severity vulnerability in the ZTE Red Magic 11 Pro (NX809J) device caused by improper privilege management. It allows non-privileged applications to perform sensitive operations by exploiting insufficient validation on a service interface. This can lead to unauthorized file writes on certain partitions and modification of writable system properties. The issue affects version GEN_NEEA_NX809J V1.0.0B14MR1. No official patch or remediation guidance is currently available, and no exploits are known in the wild.

The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the user list interface. Attackers can reset the passwords of obtained user information, causing risks such as unauthorized operations.