https://vulnogram.org/ Most recent CVEs assigned by ZTE Corporation (zte). https://vulnogram.org/seaview/icons/zte.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-108506 https://vulnogram.org/CVE-2026-108506 ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information. Medium Sat, 10 Oct 2026 09:08:04 GMT https://vulnogram.org/CVE-2026-108505 https://vulnogram.org/CVE-2026-108505 ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information. Low Sat, 10 Oct 2026 08:50:06 GMT https://vulnogram.org/CVE-2026-108504 https://vulnogram.org/CVE-2026-108504 ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information. Medium Sat, 10 Oct 2026 07:19:20 GMT https://vulnogram.org/CVE-2026-108503 https://vulnogram.org/CVE-2026-108503 ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information. Low Sat, 10 Oct 2026 06:52:58 GMT https://vulnogram.org/CVE-2026-108502 https://vulnogram.org/CVE-2026-108502 ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs. Low Sat, 10 Oct 2026 06:36:48 GMT https://vulnogram.org/CVE-2026-108501 https://vulnogram.org/CVE-2026-108501 ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface. Medium Sat, 10 Oct 2026 03:43:13 GMT https://vulnogram.org/CVE-2026-86556 https://vulnogram.org/CVE-2026-86556 There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information. Medium Network Exploitable Wed, 30 Sep 2026 02:14:19 GMT https://vulnogram.org/CVE-2026-86555 https://vulnogram.org/CVE-2026-86555 The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it. Medium Sun, 20 Sep 2026 09:15:43 GMT https://vulnogram.org/CVE-2026-86554 https://vulnogram.org/CVE-2026-86554 SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/… Medium Sun, 20 Sep 2026 07:55:08 GMT https://vulnogram.org/CVE-2026-86553 https://vulnogram.org/CVE-2026-86553 SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/ver… High Sun, 20 Sep 2026 03:17:20 GMT https://vulnogram.org/CVE-2026-86552 https://vulnogram.org/CVE-2026-86552 SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email add… Medium Sun, 20 Sep 2026 03:01:00 GMT https://vulnogram.org/CVE-2026-86551 https://vulnogram.org/CVE-2026-86551 The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database. Low Sun, 20 Sep 2026 01:55:32 GMT https://vulnogram.org/CVE-2026-86550 https://vulnogram.org/CVE-2026-86550 NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables scrip… Medium Network Exploitable Tue, 08 Sep 2026 08:14:25 GMT https://vulnogram.org/CVE-2026-49003 https://vulnogram.org/CVE-2026-49003 Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, t… Critical Mon, 31 Aug 2026 09:43:24 GMT https://vulnogram.org/CVE-2026-9668 https://vulnogram.org/CVE-2026-9668 With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverag… Medium Wed, 26 Aug 2026 08:02:07 GMT https://vulnogram.org/CVE-2026-49008 https://vulnogram.org/CVE-2026-49008 By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device. Medium Fri, 07 Aug 2026 08:03:49 GMT https://vulnogram.org/CVE-2026-49007 https://vulnogram.org/CVE-2026-49007 By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface. High Network Exploitable Fri, 07 Aug 2026 07:39:03 GMT https://vulnogram.org/CVE-2026-49006 https://vulnogram.org/CVE-2026-49006 By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission. Medium Fri, 07 Aug 2026 07:13:58 GMT https://vulnogram.org/CVE-2026-49005 https://vulnogram.org/CVE-2026-49005 The root password hash of the device can be obtained through unencrypted information in the firmware. Low Fri, 07 Aug 2026 03:36:08 GMT https://vulnogram.org/CVE-2026-8029 https://vulnogram.org/CVE-2026-8029 The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and l… Low Wed, 05 Aug 2026 08:36:02 GMT https://vulnogram.org/CVE-2026-49004 https://vulnogram.org/CVE-2026-49004 The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database sup… Medium Wed, 05 Aug 2026 06:19:01 GMT https://vulnogram.org/CVE-2026-40000 https://vulnogram.org/CVE-2026-40000 The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fi… Low Mon, 27 Jul 2026 09:35:01 GMT https://vulnogram.org/CVE-2026-49002 https://vulnogram.org/CVE-2026-49002 Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information. Critical Network Exploitable Wed, 27 May 2026 08:19:15 GMT https://vulnogram.org/CVE-2026-49001 https://vulnogram.org/CVE-2026-49001 Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution of unintended operations such as tampering with configuration data. Medium Wed, 27 May 2026 07:33:17 GMT https://vulnogram.org/CVE-2026-49000 https://vulnogram.org/CVE-2026-49000 An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implementation, which may lead to data leakage or tampering, such as hard-coded keys or the use… High Network Exploitable Wed, 27 May 2026 03:38:48 GMT https://vulnogram.org/CVE-2026-48999 https://vulnogram.org/CVE-2026-48999 Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers… Medium Wed, 27 May 2026 02:25:20 GMT https://vulnogram.org/CVE-2026-44410 https://vulnogram.org/CVE-2026-44410 This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks. Low Tue, 26 May 2026 09:39:55 GMT https://vulnogram.org/CVE-2026-44409 https://vulnogram.org/CVE-2026-44409 There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure. Medium Fri, 22 May 2026 03:49:56 GMT https://vulnogram.org/CVE-2026-44408 https://vulnogram.org/CVE-2026-44408 There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can modify configuration through the interface. Medium Tue, 19 May 2026 07:45:05 GMT https://vulnogram.org/CVE-2026-44407 https://vulnogram.org/CVE-2026-44407 A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service. Medium Thu, 07 May 2026 07:33:17 GMT https://vulnogram.org/CVE-2026-44406 https://vulnogram.org/CVE-2026-44406 ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a D… Medium Thu, 07 May 2026 06:49:54 GMT https://vulnogram.org/CVE-2026-40004 https://vulnogram.org/CVE-2026-40004 There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges. Medium Thu, 07 May 2026 03:47:06 GMT https://vulnogram.org/CVE-2026-40003 https://vulnogram.org/CVE-2026-40003 ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwri… Medium Thu, 07 May 2026 01:15:24 GMT https://vulnogram.org/CVE-2026-40001 https://vulnogram.org/CVE-2026-40001 There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass. Medium Wed, 06 May 2026 08:48:10 GMT https://vulnogram.org/CVE-2026-40002 https://vulnogram.org/CVE-2026-40002 Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerab… Medium Fri, 17 Apr 2026 07:40:58 GMT https://vulnogram.org/CVE-2026-40436 https://vulnogram.org/CVE-2026-40436 The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the… High Mon, 13 Apr 2026 06:31:49 GMT https://vulnogram.org/CVE-2025-66315 https://vulnogram.org/CVE-2025-66315 There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settings, an attacker can execute write permissions in a specific directory. Medium Fri, 09 Jan 2026 02:24:58 GMT https://vulnogram.org/CVE-2025-66314 https://vulnogram.org/CVE-2025-66314 Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ElasticNet UME R32: ElasticNet_UME_R32_V16.23.20.04. High Network Exploitable Thu, 27 Nov 2025 02:08:31 GMT https://vulnogram.org/CVE-2025-46583 https://vulnogram.org/CVE-2025-46583 There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Service interface, allowing an attacker to exploit it to carry out a DoS attack. Medium Network Exploitable Mon, 27 Oct 2025 09:23:38 GMT https://vulnogram.org/CVE-2025-46582 https://vulnogram.org/CVE-2025-46582 A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security. High Mon, 27 Oct 2025 08:44:49 GMT https://vulnogram.org/CVE-2025-46581 https://vulnogram.org/CVE-2025-46581 ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges. Critical Network Exploitable Tue, 14 Oct 2025 08:54:42 GMT https://vulnogram.org/CVE-2025-26711 https://vulnogram.org/CVE-2025-26711 There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface. Medium Tue, 16 Sep 2025 09:35:38 GMT https://vulnogram.org/CVE-2025-26710 https://vulnogram.org/CVE-2025-26710 There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain information through interfaces without authorization, causing the risk of information disclosure. Low Tue, 16 Sep 2025 09:14:00 GMT https://vulnogram.org/CVE-2025-26709 https://vulnogram.org/CVE-2025-26709 There is an unauthorized access vulnerability in ZTE F50. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface Medium Fri, 15 Aug 2025 10:35:22 GMT https://vulnogram.org/CVE-2025-46580 https://vulnogram.org/CVE-2025-46580 There is a code-related vulnerability in the GoldenDB database product. Attackers can access system tables to disrupt the normal operation of business SQL. High Sun, 27 Apr 2025 01:49:16 GMT https://vulnogram.org/CVE-2025-46579 https://vulnogram.org/CVE-2025-46579 There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download and open the affected file, the DDE commands can be executed. High Sun, 27 Apr 2025 01:34:35 GMT https://vulnogram.org/CVE-2025-46578 https://vulnogram.org/CVE-2025-46578 There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and extract sensitive database information. Medium Sun, 27 Apr 2025 01:30:44 GMT https://vulnogram.org/CVE-2025-46577 https://vulnogram.org/CVE-2025-46577 There is a SQL injection vulnerability in the GoldenDB database product. Attackers can inject commands to extract database information. Medium Sun, 27 Apr 2025 01:21:27 GMT https://vulnogram.org/CVE-2025-46576 https://vulnogram.org/CVE-2025-46576 There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restrictions and delete content. Medium Sun, 27 Apr 2025 01:16:37 GMT https://vulnogram.org/CVE-2025-46575 https://vulnogram.org/CVE-2025-46575 There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information. Medium Sun, 27 Apr 2025 01:12:36 GMT