ZTE vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-86553 SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process.High 8.8 · Sep 20, 2026
• CVE-2026-49003 Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultCritical 9.6 · Aug 31, 2026
• CVE-2026-49007 By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.High 7.5 · Aug 7, 2026
• CVE-2026-49002 Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond thCritical 9.1 · May 27, 2026
• CVE-2026-49000 An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implemHigh 7 · May 27, 2026
• CVE-2026-40436 The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to thHigh 7.1 · Apr 13, 2026
• CVE-2026-34472 Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local neHigh 7.1 · Mar 30, 2026
• CVE-2025-66314 Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affectHigh 7.5 · Nov 26, 2025
• CVE-2025-46582 A private key disclosure vulnerability exists in ZTE's ZXMP M721 product.High 7.7 · Oct 27, 2025
• CVE-2025-46581 ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability.Critical 9.8 · Oct 14, 2025
• CVE-2025-46580 There is a code-related vulnerability in the GoldenDB database product.High 7.7 · Apr 26, 2025
• CVE-2025-46579 There is a DDE injection vulnerability in the GoldenDB database product.High 8.4 · Apr 26, 2025
• CVE-2024-22063 The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability.High 7.6 · Dec 30, 2024
• CVE-2024-22066 There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router .High 7.5 · Oct 29, 2024
• CVE-2024-45416 The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function.High 8.1 · Sep 16, 2024
• CVE-2024-45415 The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function.Critical 9.8 · Sep 16, 2024
• CVE-2024-45414 The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function.Critical 9.8 · Sep 16, 2024
• CVE-2024-45413 The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function.High 8.1 · Sep 16, 2024
• CVE-2024-22069 There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and chanHigh 7.1 · Aug 8, 2024
• CVE-2023-25646 There is an unauthorized access vulnerability in ZTE H388X.High 7.1 · Jun 20, 2024
• CVE-2024-22064 ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys duringHigh 8.3 · May 14, 2024
• CVE-2023-25643 There is a command injection vulnerability in some ZTE mobile internet products.High 8.4 · Dec 14, 2023
• CVE-2023-25645 There is a permission and access control vulnerability in some ZTE AndroidTV STBs.High 7.7 · Jun 16, 2023
• CVE-2022-39075 There is an unauthorized access vulnerability in some ZTE mobile phones.High 7.1 · May 30, 2023
• CVE-2022-39071 There is an unauthorized access vulnerability in some ZTE mobile phones.High 7.1 · May 30, 2023