Vendor
ZTE
131 known vulnerabilities.
Products
67 results · Clear filters · Feed
-
Medium 6.5
SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product
SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.
-
Medium 5.5
Unauthorized access vulnerability in ZTE Z80 Ultra product
ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information.
-
Medium 5.5
Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.
-
Medium 5.7
Unauthorized access vulnerability in ZTE Z80 Ultra product
ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.
-
Medium 5.3
An information disclosure vulnerability in ZTE U30 Air product
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information.
-
Medium 6.2
Hardcoded Key Vulnerability in ZTE SmartLife APP
The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.
-
Medium 4.3
Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.se…
-
Medium 5.4CVE-2026-86552 Public exploit
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via …
-
Medium 6.5
UXSS vulnerability in ZTE browser products
NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script executi…
-
Medium 6.3
SQL injection vulnerability in ZTE SCP product
With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This v…
-
Medium 6.5
Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.
-
Medium 5.3
TLS credential leakage vulnerability in ZTE F689 product
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.
-
Medium 6.5
PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product
The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the…
-
Medium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product
Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution of unintended operations such as tampering with configuration data.
-
Medium 5.7
Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product
Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers can ther…
-
Medium 5.7
Information disclosure vulnerability in ZTE MU5250
There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.
-
Medium 6.3
Unauthorized access vulnerability in ZTE MU5250
There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can modify configuration through the interface.
-
Medium 4.7
Remote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartview
A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service.
-
Medium 5.7
DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview
ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijack…
-
Medium 5.5
openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview
There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.
-
Medium 5.1CVE-2026-40003 Public exploit
USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the …
-
Medium 5.2
Local privilege escalation vulnerability in ZTE PROCESS Guard service of the cloud computer client
There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass.
-
Medium 5.0
ZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.
Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting this vulnerability, an…
-
Medium 4.3
ZTE MF258K Pro Version Server has a Configuration Defect Vulnerability
There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settings, an attacker can execute write permissions in a specific directory.
-
Medium 5.3
DOS Vulnerability in ZTE MC889A Pro product
There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Service interface, allowing an attacker to exploit it to carry out a DoS attack.
-
Medium 5.7
There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interf…
-
Medium 5.7
Unauthorized Access Vulnerability in ZTE F50
There is an unauthorized access vulnerability in ZTE F50. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface
-
Medium 6.5
ZTE GoldenDB Database product has SQL injection vulnerabilities in multiple interfaces
There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and extract sensitive database information.
-
Medium 6.5
ZTE GoldenDB Database product has an SQL injection vulnerability
There is a SQL injection vulnerability in the GoldenDB database product. Attackers can inject commands to extract database information.
-
Medium 5.4
ZTE GoldenDB Database product has a privilege escalation vulnerability
There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restrictions and delete content.
-
Medium 4.9
ZTE GoldenDB Database product has an information disclosure vulnerability
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
-
Medium 4.1
ZTE GoldenDB Database product has an input validation vulnerability
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
-
Medium 4.9
Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: fro…
-
Medium 4.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 6.4
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 5.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 5.4
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 5.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 4.2
ZTELink has a configuration defect vulnerability
There is a configuration defect vulnerability in ZTELink 5.4.9 for iOS. This vulnerability is caused by a flaw in the WiFi parameter configuration of the ZTELink. An attacker can obtain unauthorized access to the WiFi service.
-
Medium 6.8
ZTE NH8091 product has an improper permission control vulnerability
ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands.