Threat database

CVE-2025-66315 is a medium severity vulnerability affecting ZTE MF258K Pro devices due to improper directory permission settings in the version server. This misconfiguration allows an attacker with limited privileges to write to a specific directory remotely without user interaction, potentially leading to denial of service or disruption of device functionality. The vulnerability does not impact confidentiality or integrity directly but affects availability. No known exploits are reported in the wild yet. The affected versions are ZTE_MF258kPRO_PLAY_V1.0.0B03 and ZTE_MF258PRO_STD_V1.0.0B04. Exploitation requires network access and limited privileges but no user interaction.

Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ElasticNet UME R32: ElasticNet_UME_R32_V16.23.20.04.

There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Service interface, allowing an attacker to exploit it to carry out a DoS attack.

A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security.

CVE-2025-46581 is a critical remote code execution vulnerability in ZTE's ZXCDN-SNS V3.01.02 product, caused by improper control of code generation (CWE-94). It allows unauthenticated attackers to execute arbitrary commands remotely with non-root privileges. The vulnerability stems from a Struts component, enabling exploitation over the network without user interaction. The CVSS score of 9.8 reflects its high impact on confidentiality, integrity, and availability. Although no public exploits are known yet, the severity and ease of exploitation make it a significant threat. European organizations using ZXCDN for content delivery or network services are at risk, especially in countries with higher ZTE market presence. Immediate mitigation involves applying vendor patches once available, restricting network access to ZXCDN management interfaces, and monitoring for suspicious activity.

There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface.

There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain information through interfaces without authorization, causing the risk of information disclosure.

There is an unauthorized access vulnerability in ZTE F50. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K.use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through <= 1.0.0.

The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_jdt' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

There is a Cross-site scripting (XSS)  vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.

Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro