ZTE vulnerabilities
We track 42 vulnerabilities in ZTE products across 53 products. 42 are rated high or critical, and none are known to be exploited. The most recent was published on September 20, 2026.
Latest ZTE vulnerabilities
- 8.8 High severity
SmartLife: Improper Privilege Management
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv t
- 9.6 Critical severity
ZXDU68 S202 V5.0: Improper Authentication
Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tam
- 9.1 Critical severity
ZXUniPOS NDS-LTE: Improper Access Control
Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.
- 7.0 High severity
An insecure password scheme refers to vulnerabilities arising from improper selection of…
An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implementation, which may lead to data leakage or tampering, such as hard-coded keys or the use of weak en
- 7.5 High severity
MU5250: Missing Authorization
There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.
- 7.5 High severity
ZXCLOUD iRAI: Use of Externally-Controlled Format String
A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service.
- 7.8 High severity
ZXCLOUD iRAI: Uncontrolled Search Path Element
ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijacki
- 7.8 High severity
ZXCLOUD iRAI: Uncontrolled Search Path Element
There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.
- 8.8 High severity
Red Magic 11 Pro (NX809J): Improper Privilege Management
Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an
- 7.1 High severity
Zxhn H188a Firmware: Exposure of Sensitive Information to an Unauthorized Actor
Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the de
- 8.8 High severity
MF258K: Incorrect Authorization
There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settings, an attacker can execute write permissions in a specific directory.
- 7.5 High severity
ElasticNet UME R32: Improper Privilege Management
Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ElasticNet UME R32: ElasticNet_UME_R32_V16.23.20.04.
- 7.7 High severity
ZXMP M721: Use of Hard-coded Cryptographic Key
A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security.
- 9.8 Critical severity
ZXCDN: Improper Control of Generation of Code
ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges.
- 7.5 High severity
GoldenDB: Uncontrolled Resource Consumption
There is a code-related vulnerability in the GoldenDB database product. Attackers can access system tables to disrupt the normal operation of business SQL.
- 7.8 High severity
GoldenDB: Improper Control of Generation of Code
There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download and open the affected file, the DDE commands can be executed.
- 7.5 High severity
GoldenDB: Improper Neutralization of Special Elements used in an SQL Command
There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and extract sensitive database information.
- 7.5 High severity
GoldenDB: Generation of Error Message Containing Sensitive Information
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
- 9.0 Critical severity
ZENIC ONE R58: Improper Neutralization of Formula Elements in a CSV File
The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices.
- 8.8 High severity
NH8091: Improper Access Control
ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands.
- 8.8 High severity
MF258 Pro: Improper Neutralization of Special Elements used in an OS Command
There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.
- 8.1 High severity
zxhn_z500_firmware: Inclusion of Functionality from Untrusted Control Sphere
The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates on all files in this directory and executes them using the f
- 9.8 Critical severity
zxhn_z500_firmware: Stack-based Buffer Overflow
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post request. The checksum is sent encrypted in the request, the func
- 9.8 Critical severity
zxhn_z500_firmware: Stack-based Buffer Overflow
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the encrypted data is supplied base64 encoded. The decoded ciphertext
- 8.1 High severity
zxhn_z500_firmware: Stack-based Buffer Overflow
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the decrypted data is stored on the stack without checking its length
- 8.8 High severity
ZXV10 XT802: Improper Privilege Management
There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords.
- 8.8 High severity
ZXCLOUD IRAI: Incorrect Default Permissions
There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration.
- 7.8 High severity
ZXCLOUD iRAI: Improper Control of Generation of Code
There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges.
- 7.8 High severity
ZXCLOUD iRAI: Uncontrolled Search Path Element
There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges.
- 7.8 High severity
ZXCLOUD iRAI: Improper Privilege Management
There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.
- 7.5 High severity
MC801A: Improper Handling of Exceptional Conditions
There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, an attacker could use the vulnerability to perform a denial of service attack.
- 8.8 High severity
MC801A: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.
- 8.0 High severity
Mobile Internet Products: Improper Neutralization of Special Elements used in an SQL Command
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.
- 7.8 High severity
ZXCLOUD iRAI: Incorrect Permission Assignment for Critical Resource
There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges.
- 8.8 High severity
MF286R: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.
- 7.7 High severity
UP T2 4K, ZXV10 B866V2-H, ZXV10 B866V2, ZXV10…: Incorrect Default Permissions
There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnera
- 9.8 Critical severity
MF286R: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.
- 9.8 Critical severity
ZXA10 C3XX: Improper Access Control
There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to log in to the device and execute any operation.
- 8.8 High severity
MF286R: Improper Neutralization of Special Elements used in an SQL Command
There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.
- 7.5 High severity
ZXMP M721: Insertion of Sensitive Information into Log File
ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attacker could use this vulnerability to log in to the device to obtain sensitive information.