Zte
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Zte product.
RSS Feeds for Zte security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Zte products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Zte Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2025 there have been 12 vulnerabilities in Zte with an average score of 6.5 out of ten. Last year, in 2024 Zte had 13 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Zte in 2025 could surpass last years number. Last year, the average CVE base score was greater by 1.02
Year | Vulnerabilities | Average Score |
---|---|---|
2025 | 12 | 6.54 |
2024 | 13 | 7.56 |
2023 | 3 | 8.03 |
2022 | 5 | 6.92 |
2021 | 5 | 6.88 |
2020 | 4 | 6.23 |
2019 | 3 | 6.67 |
2018 | 2 | 8.50 |
It may take a day or so for new Zte vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Zte Security Vulnerabilities
There is a code-related vulnerability in the GoldenDB database product
CVE-2025-46580
7.5 - High
- April 27, 2025
There is a code-related vulnerability in the GoldenDB database product. Attackers can access system tables to disrupt the normal operation of business SQL.
There is an information disclosure vulnerability in the GoldenDB database product
CVE-2025-46574
5.3 - Medium
- April 27, 2025
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
There is an information disclosure vulnerability in the GoldenDB database product
CVE-2025-46575
7.5 - High
- April 27, 2025
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
Generation of Error Message Containing Sensitive Information
There is a Permission Management and Access Control vulnerability in the GoldenDB database product
CVE-2025-46576
6.5 - Medium
- April 27, 2025
There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restrictions and delete content.
There is a SQL injection vulnerability in the GoldenDB database product
CVE-2025-46577
7.5 - High
- April 27, 2025
There is a SQL injection vulnerability in the GoldenDB database product. Attackers can inject commands to extract database information.
SQL Injection
There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product
CVE-2025-46578
7.5 - High
- April 27, 2025
There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and extract sensitive database information.
SQL Injection
There is a DDE injection vulnerability in the GoldenDB database product
CVE-2025-46579
7.8 - High
- April 27, 2025
There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download and open the affected file, the DDE commands can be executed.
Code Injection
Improper Privilege Management vulnerability in ZTE GoldenDB
CVE-2025-26705
7.5 - High
- March 11, 2025
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
Improper Privilege Management vulnerability in ZTE GoldenDB
CVE-2025-26706
5.3 - Medium
- March 11, 2025
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.
Improper Privilege Management vulnerability in ZTE GoldenDB
CVE-2025-26704
4.3 - Medium
- March 11, 2025
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
Improper Privilege Management vulnerability in ZTE GoldenDB
CVE-2025-26703
4.3 - Medium
- March 11, 2025
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.
Improper Input Validation vulnerability in ZTE GoldenDB
CVE-2025-26702
7.5 - High
- March 11, 2025
Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.
The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability
CVE-2024-22063
9 - Critical
- December 30, 2024
The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices.
CSV Injection
ZTE NH8091 product has an improper permission control vulnerability
CVE-2024-22067
8.8 - High
- November 18, 2024
ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands.
There is a command injection vulnerability in ZTE MF258 Pro product
CVE-2024-22065
8.8 - High
- October 29, 2024
There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.
Shell injection
The wireless router WRTM326 from SECOM does not properly validate a specific parameter
CVE-2024-10119
9.8 - Critical
- October 18, 2024
The wireless router WRTM326 from SECOM does not properly validate a specific parameter. An unauthenticated remote attacker could execute arbitrary system commands by sending crafted requests.
Shell injection
There is a buffer overflow vulnerability in ZTE MF296R
CVE-2022-39068
6.5 - Medium
- September 18, 2024
There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacker could use the vulnerability to perform a denial of service attack.
Memory Corruption
There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker
CVE-2024-22062
8.8 - High
- July 09, 2024
There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration.
Incorrect Default Permissions
There is an unauthorized access vulnerability in ZTE H388X
CVE-2023-25646
6.4 - Medium
- June 20, 2024
There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations.
Improper Preservation of Permissions
ZTE ZXUN-ePDG product
CVE-2024-22064
6.5 - Medium
- May 14, 2024
ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked.
Improper Initialization
There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI
CVE-2023-41782
4.8 - Medium
- January 05, 2024
There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code.
DLL preloading
There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission
CVE-2023-41779
5.5 - Medium
- January 03, 2024
There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed.
AuthZ
There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges
CVE-2023-41776
7.8 - High
- January 03, 2024
There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.
Improper Privilege Management
There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI
CVE-2023-41780
7.8 - High
- January 03, 2024
There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges.
DLL preloading
There is a command injection vulnerability of ZTE's ZXCLOUD iRAI
CVE-2023-41783
7.8 - High
- January 03, 2024
There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges.
Code Injection
There is an arbitrary file download vulnerability in ZXCLOUD iRAI
CVE-2023-25650
6.5 - Medium
- December 14, 2023
There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads.
There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product
CVE-2023-25648
7.8 - High
- December 14, 2023
There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges.
Incorrect Permission Assignment for Critical Resource
There is a command injection vulnerability in ZTE MF286R
CVE-2022-39073
9.8 - Critical
- January 06, 2023
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.
Command Injection
ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow.
CVE-2022-45957
7.5 - High
- December 12, 2022
ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow.
Memory Corruption
ZTE OTCP product is impacted by a permission and access control vulnerability
CVE-2022-23143
6.5 - Medium
- December 05, 2022
ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use this vulnerability to maliciously delete and modify files.
Incorrect Permission Assignment for Critical Resource
There is a SQL injection vulnerability in ZTE MF286R
CVE-2022-39066
8.8 - High
- November 22, 2022
There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.
SQL Injection
There is a buffer overflow vulnerability in ZTE MF286R
CVE-2022-39067
6.5 - Medium
- November 22, 2022
There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticated attacker could use the vulnerability to perform a denial of service attack.
Classic Buffer Overflow
There is a SQL injection vulnerability in ZTE ZAIP-AIE
CVE-2022-39069
5.3 - Medium
- November 08, 2022
There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack by building malicious requests. Exploitation of this vulnerability could cause the leakage of the current table content.
SQL Injection
ZTE BigVideo analysis product has an input verification vulnerability
CVE-2021-21751
8.1 - High
- December 27, 2021
ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and back verifications when configuring the large screen page, an attacker with high privileges could exploit this vulnerability to tamper with the URL and cause service exception.
ZTE BigVideo Analysis product has a privilege escalation vulnerability
CVE-2021-21750
7.8 - High
- December 27, 2021
ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with ordinary user permissions could exploit this vulnerability to gain unauthorized access.
Improper Privilege Management
There is an information leak vulnerability in the message service app of a ZTE mobile phone
CVE-2021-21742
5.5 - Medium
- September 25, 2021
There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.
The management system of ZXCDN is impacted by the information leak vulnerability
CVE-2021-21733
4.9 - Medium
- May 19, 2021
The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by the program, and then obtain some sensitive information. This affects ZXCDN V7.01 all versions up to IAMV7.01.01.02.
Information Disclosure
A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused
CVE-2021-21731
8.1 - High
- April 13, 2021
A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the request comes from a trusted user. The attacker could submit a malicious request to the affected device to delete the data. This affects: ZXCLOUD iRAI All versions up to KVM-ProductV6.03.04
Session Riding
A ZTE product is impacted by an XSS vulnerability
CVE-2020-6876
5.4 - Medium
- October 26, 2020
A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts into the web module, a remote attacker could trigger an XSS attack when the user browses the web page. Then the attacker could use the vulnerability to steal user cookies or destroy the page structure. This affects: eVDC ZXCLOUD-iROSV6.03.04
XSS
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL
CVE-2020-12695
7.5 - High
- June 08, 2020
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
Incorrect Default Permissions
ZTE's SDON controller is impacted by the resource management error vulnerability
CVE-2020-6867
5.5 - Medium
- April 30, 2020
ZTE's SDON controller is impacted by the resource management error vulnerability. When RPC is frequently called by other applications in the case of mass traffic data in the system, it will result in no response for a long time and memory overflow risk. This affects: ZENIC ONE R22b versions V16.19.10P02SP002 and V16.19.10P02SP005.
Buffer Overflow
ZTE SDN controller platform is impacted by an information leakage vulnerability
CVE-2020-6865
6.5 - Medium
- April 30, 2020
ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program's failure to optimize the response of failure to the request, the caller can directly view the internal error code location of the component. Attackers could exploit this vulnerability to obtain sensitive information. This affects: OSCP versions V16.19.10 and V16.19.20.
Information Disclosure
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability
CVE-2019-3431
9.8 - Critical
- December 23, 2019
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers could sniff unencrypted account and password through the network for front-end system access.
Insufficiently Protected Credentials
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have an information disclosure vulnerability
CVE-2019-3430
4.9 - Medium
- December 23, 2019
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have an information disclosure vulnerability. Attackers could use this vulnerability to collect data information and damage the system.
Information Disclosure
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability
CVE-2019-3429
5.3 - Medium
- December 23, 2019
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could obtain log file information without authorization, causing the disclosure of sensitive information.
Insertion of Sensitive Information into Log File
All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may
CVE-2018-7365
7.2 - High
- December 20, 2018
All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized user to perform unauthorized operations.
Untrusted Path
All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability
CVE-2018-7364
9.8 - Critical
- December 07, 2018
All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.