Local privilege escalation and code execution in ZTE PROCESS Guard service

There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass.

• ZTE PROCESS Guard service in the cloud computer client: the record identifies ZXCLOUD-iRAI-ClientV7.2X as affected.
• The product default status is unaffected, but the record confirms only the release listed above as affected. Other branches must not be assumed safe.
• No fixed release, corrected version boundary, or confirmed parallel-branch status is provided in the available evidence.

The flaw is in the ZTE PROCESS Guard service of the cloud computer client and is classified as Improper Privilege Management. A local actor with low privileges may be able to abuse the service with low attack complexity and without user interaction to achieve local arbitrary code execution, privilege escalation, and a bypass of path traversal controls.

The record identifies local reachability and indicates that the impact scope can change beyond the vulnerable component. The public detail does not identify the affected interface or IPC endpoint, the specific attacker-controlled input, the path validation mechanism, how code execution is triggered, or the exact privilege boundary that is crossed. A payload, path, process sequence, or other exploit procedure therefore cannot be established from the available evidence.

Exploitation requires local access to a system running the cloud computer client and low privileges. The supplied attack characterization indicates low complexity and no user interaction.

The supplied record does not confirm a public exploit, exploitation campaign, or ransomware campaign. The available vulnerability assessment records exploitation as none and automation as no; this describes the recorded assessment and does not prove that exploitation has never occurred in any environment.

The flaw may allow a local, low-privileged actor to execute arbitrary code and escalate privileges through the PROCESS Guard service. The described technical outcome primarily affects integrity and availability; the current assessment does not identify a confidentiality impact.

The scope is marked as changed, so consequences may extend to resources outside the vulnerable component. Possible organizational effects include unauthorized changes to the client or related systems and service disruption, but the specific affected resources and practical extent remain unknown.

If exploited, a low-privileged local account may cross the service's privilege boundary and make unauthorized changes on the system. Possible consequences include loss of software or data integrity managed by the service, along with disruption of the client or related components.

The current assessment does not identify a confidentiality impact. The scope is marked as changed, so consequences may extend beyond the PROCESS Guard service, but the affected target and practical blast radius have not been documented. The record provides no evidence of a named breach or affected organization.

1. Identify systems running the ZTE cloud computer client with version ZXCLOUD-iRAI-ClientV7.2X and prioritize them for remediation.
2. Apply an official ZTE update or remediation instruction when one is provided. No exact fixed release or confirmed mitigation is present in the record.
3. Until vendor guidance is available, reduce unnecessary local access to systems hosting the client. This is a general precaution, not a ZTE-confirmed mitigation.
4. Do not assume that a later release or parallel branch is unaffected solely because its status has not been documented.

1. Inventory workstations and servers running the ZTE cloud computer client, then identify systems where the PROCESS Guard component is present or active.
2. Check the installed client release and compare it with the affected branch listed in affected_summary. Do not use the status of another branch to conclude that this branch is safe.
3. Review the service's execution privileges and look for unusual process, file, or system-permission changes associated with the client. This is precautionary monitoring, not a vendor-confirmed indicator.
4. The record provides no named log events, specific paths, IOCs, or detection signatures for this flaw. The absence of matching log evidence does not prove that a system is unaffected.