Zte

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Zte product.

RSS Feeds for Zte security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Zte products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Zte Sorted by Most Security Vulnerabilities since 2018

Zte Zxcloud Irai10 vulnerabilities

Zte Zxcloud Goldendb7 vulnerabilities

Zte Goldendb5 vulnerabilities

Zte Mf286r Firmware3 vulnerabilities

Zte T54002 vulnerabilities

Zte Zxcdn2 vulnerabilities

Zte Zxun Epdg1 vulnerability

Zte Zxmp M7211 vulnerability

Zte Zxhn H388x Firmware1 vulnerability

Zte Zxhn H108ns Firmware1 vulnerability

Zte Zenic One R581 vulnerability

Zte Wrtm326 Firmware1 vulnerability

Zte Otcp Firmware1 vulnerability

Zte Nh8091 Firmware1 vulnerability

Zte Mf296r Firmware1 vulnerability

Zte Mf258k Pro Firmware1 vulnerability

Zte Mc889a Pro1 vulnerability

By the Year

In 2026 there have been 1 vulnerability in Zte with an average score of 4.3 out of ten. Last year, in 2025 Zte had 18 security vulnerabilities published. Right now, Zte is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 2.26

Year	Vulnerabilities	Average Score
2026	1	4.30
2025	18	6.56
2024	13	7.56
2023	3	8.03
2022	5	6.92
2021	5	6.88
2020	5	0.00
2019	3	6.67
2018	12	0.00

It may take a day or so for new Zte vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Zte Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-66315	Jan 09, 2026	Config Defect in ZTE MF258K Pro Router Allows Write Access There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settings, an attacker can execute write permissions in a specific directory.
CVE-2025-66314	Nov 27, 2025	CVE-2025-66314: Priv Escalation via ACL Bypass in ZTE ElasticNet UME R32 v16.23.20.04 Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ElasticNet UME R32: ElasticNet_UME_R32_V16.23.20.04.
CVE-2025-46583	Oct 27, 2025	ZTE MC889A Pro DoS via SMS Input Validation There is a Denial of ServiceDoSvulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Service interface, allowing an attacker to exploit it to carry out a DoS attack.	Mc889a Pro
CVE-2025-46582	Oct 27, 2025	ZTE ZXMP M721 Private Key Disclosure via Auth Bypass A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security.	Zxmp M721
CVE-2025-46581	Oct 14, 2025	ZTE ZXCDN Struts RCE: Unauth Remote Code Exec, Non-Root ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges.	Zxcdn
CVE-2025-26711	Sep 16, 2025	Unauthorized Access via Web Module in ZTE T5400 There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface.	T5400
CVE-2025-26710	Sep 16, 2025	Unprotected Access Control Exposes Info on ZTE T5400 There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain information through interfaces without authorization, causing the risk of information disclosure.	T5400
CVE-2025-46580	Apr 27, 2025	GoldenDB DB: System Table Access Allows SQL Disruption There is a code-related vulnerability in the GoldenDB database product. Attackers can access system tables to disrupt the normal operation of business SQL.	Zxcloud Goldendb
CVE-2025-46574	Apr 27, 2025	GoldenDB Info Disclosure via Error Messages There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.	Zxcloud Goldendb
CVE-2025-46575	Apr 27, 2025	GoldenDB Info Disclosure via Err Msgs (CVE-2025-46575) There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.	Zxcloud Goldendb
CVE-2025-46576	Apr 27, 2025	GoldenDB Permission Bypass via Request Manipulation There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restrictions and delete content.	Zxcloud Goldendb
CVE-2025-46577	Apr 27, 2025	GoldenDB SQLi Allows Data Exfiltration There is a SQL injection vulnerability in the GoldenDB database product. Attackers can inject commands to extract database information.	Zxcloud Goldendb
CVE-2025-46578	Apr 27, 2025	SQL injection in GoldenDB database interfaces There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and extract sensitive database information.	Zxcloud Goldendb
CVE-2025-46579	Apr 27, 2025	GoldenDB DDE Injection via Interface (CVE-2025-46579) There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download and open the affected file, the DDE commands can be executed.	Zxcloud Goldendb
CVE-2025-26702	Mar 11, 2025	ZTE GoldenDB <=6.1.03.04 Improper Input Validation (IDM) Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.	Goldendb
CVE-2025-26703	Mar 11, 2025	ZTE GoldenDB 6.1.03–6.1.03.04 Privilege Escalation via Improper Prv. Mngmt Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.	Goldendb
CVE-2025-26704	Mar 11, 2025	ZTE GoldenDB 6.1.03-6.1.03.05: PrivEsc via Improper Privilege Mgmt Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.	Goldendb
CVE-2025-26705	Mar 11, 2025	Priv Escal in ZTE GoldenDB via IMP Priv Mgmt (6.1.03-6.1.03.05) Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.	Goldendb
CVE-2025-26706	Mar 11, 2025	ZTE GoldenDB <=6.1.03.07 Privilege Escalation via Improper Privilege Management Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.	Goldendb
CVE-2024-22063	Dec 30, 2024	Command Injection in ZTE ZENIC ONE R58 Authenticated Exploit The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices.	Zenic One R58
CVE-2024-22067	Nov 18, 2024	ZTE NH8091 Improper Auth. Control Enables Remote Command Exec ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands.	Nh8091 Firmware
CVE-2024-22065	Oct 29, 2024	Command Injection via Ping Diagnosis in ZTE MF258 Pro Router There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.	Mf258k Pro Firmware
CVE-2024-10119	Oct 18, 2024	SECOM WRTM326 IoT Router Parameter Validation Failure Allows RCE The wireless router WRTM326 from SECOM does not properly validate a specific parameter. An unauthenticated remote attacker could execute arbitrary system commands by sending crafted requests.	Wrtm326 Firmware
CVE-2022-39068	Sep 18, 2024	ZTE MF296R SMS Buffer Overflow Allowing Authenticated DoS There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacker could use the vulnerability to perform a denial of service attack.	Mf296r Firmware
CVE-2024-22062	Jul 09, 2024	Perm Bypass in ZXCLOUD IRAI via Config Modification There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration.	Zxcloud Irai
CVE-2023-25646	Jun 20, 2024	ZTE H388X Serial Port Brute-Force Allows Privilege Escalation There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations.	Zxhn H388x Firmware
CVE-2024-22064	May 14, 2024	ZTE ZXUN-ePDG IKE key reuse allows session info leakage ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked.	Zxun Epdg
CVE-2023-41782	Jan 05, 2024	ZTE ZXCLOUD iRAI DLL Hijacking Exploit There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code.	Zxcloud Irai
CVE-2023-41776	Jan 03, 2024	ZTE ZXCLOUD iRAI Local PrivEsc via Fake Process Creation There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.	Zxcloud Irai
CVE-2023-41779	Jan 03, 2024	ZTE ZXCLOUD iRAI Illegal Memory Access Crash (CVE-2023-41779) There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed.	Zxcloud Irai
CVE-2023-41780	Jan 03, 2024	ZTE ZXCLOUD iRAI Unsafe DLL Loading Escalates Local Privileges There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges.	Zxcloud Irai
CVE-2023-41783	Jan 03, 2024	ZTE ZXCLOUD iRAI Command Injection Leading to Local Privilege Escalation There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges.	Zxcloud Irai
CVE-2023-25650	Dec 14, 2023	Arbitrary File Download in ZXCLOUD iRAI: Unescaped Path Param There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads.	Zxcloud Irai
CVE-2023-25648	Dec 14, 2023	ZTE ZXCLOUD iRAI: Weak Folder Permissions Enable LP Escalation via Fake DLL There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges.	Zxcloud Irai
CVE-2022-39073	Jan 06, 2023	Command Injection in ZTE MF286R Router There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.	Mf286r Firmware
CVE-2022-45957	Dec 12, 2022	ZTE ZXHN-H108NS remote stack buffer overflow (H108NSV1.0.7u_ZRD_GR2_A68) ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow.	Zxhn H108ns Firmware
CVE-2022-23143	Dec 05, 2022	ZTE OTCP Permission & Access Control Flaw Enables File Deletion ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use this vulnerability to maliciously delete and modify files.	Otcp Firmware
CVE-2022-39067	Nov 22, 2022	Buffer Overflow in ZTE MF286R WiFi Interface Causes DoS There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticated attacker could use the vulnerability to perform a denial of service attack.	Mf286r Firmware
CVE-2022-39066	Nov 22, 2022	Auth SQLi in ZTE MF286R Phonebook API There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.	Mf286r Firmware
CVE-2022-39069	Nov 08, 2022	SQLi in ZTE ZAIPAIE leaks database contents There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack by building malicious requests. Exploitation of this vulnerability could cause the leakage of the current table content.	Zaip Aie
CVE-2021-21750	Dec 27, 2021	ZTE BigVideo Analysis product has a privilege escalation vulnerability ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with ordinary user permissions could exploit this vulnerability to gain unauthorized access.	Zxin10 Cms
CVE-2021-21751	Dec 27, 2021	ZTE BigVideo analysis product has an input verification vulnerability ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and back verifications when configuring the large screen page, an attacker with high privileges could exploit this vulnerability to tamper with the URL and cause service exception.	Zxin10 Cms
CVE-2021-21742	Sep 25, 2021	There is an information leak vulnerability in the message service app of a ZTE mobile phone There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.	Axon 30 Pro Message Service
CVE-2021-21733	May 19, 2021	The management system of ZXCDN is impacted by the information leak vulnerability The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by the program, and then obtain some sensitive information. This affects ZXCDN V7.01 all versions up to IAMV7.01.01.02.	Zxcdn
CVE-2021-21731	Apr 13, 2021	A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the request comes from a trusted user. The attacker could submit a malicious request to the affected device to delete the data. This affects: ZXCLOUD iRAI All versions up to KVM-ProductV6.03.04	Zxcloud Irai
CVE-2020-6876	Oct 26, 2020	A ZTE product is impacted by an XSS vulnerability A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts into the web module, a remote attacker could trigger an XSS attack when the user browses the web page. Then the attacker could use the vulnerability to steal user cookies or destroy the page structure. This affects: eVDC ZXCLOUD-iROSV6.03.04	Evdc
CVE-2020-6870	Jun 24, 2020	The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP server to tamper with the password, and illegally download, modify, upload, or delete files, causing improper operation of the network management system and equipment. This affects: NetNumenU31R20 V12.17.20T115
CVE-2020-12695	Jun 08, 2020	The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.	Zxv10 W300
CVE-2020-6867	Apr 30, 2020	ZTE's SDON controller is impacted by the resource management error vulnerability ZTE's SDON controller is impacted by the resource management error vulnerability. When RPC is frequently called by other applications in the case of mass traffic data in the system, it will result in no response for a long time and memory overflow risk. This affects: ZENIC ONE R22b versions V16.19.10P02SP002 and V16.19.10P02SP005.	Zenic One R22b
CVE-2020-6865	Apr 30, 2020	ZTE SDN controller platform is impacted by an information leakage vulnerability ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program's failure to optimize the response of failure to the request, the caller can directly view the internal error code location of the component. Attackers could exploit this vulnerability to obtain sensitive information. This affects: OSCP versions V16.19.10 and V16.19.20.	Oscp