en
ZTE Corporation is a global telecommunications and information technology company founded in 1985. Its core business is developing integrated network, communications, computing, device, and digital solutions for telecom operators, government and enterprise customers, and consumers across an international operating footprint.
As of 10/05/2026, ZTE recorded 16 security vulnerabilities in the last 90 days across 9 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, SmartLife had the most security vulnerabilities in the ZTE ecosystem, with 5 vulnerabilities—approximately 31.25% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-86556An information disclosure vulnerability in ZTE U30 Air product | Exploitation statusNot known exploited | FixNot confirmed | Affected productU30 Air | Published09/30/2026 | SeverityMedium |
CVE-2026-86555Hardcoded Key Vulnerability in ZTE SmartLife APP | Exploitation statusNot known exploited | FixNot confirmed | Affected productSmartLife | Published09/20/2026 | SeverityMedium |
CVE-2026-86554Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP | Exploitation statusNot known exploited | FixNot confirmed | Affected productSmartLife | Published09/20/2026 | SeverityMedium |
CVE-2026-86553A password reset vulnerability in ZTE SmartLife APP | Exploitation statusNot known exploited | FixNot confirmed | Affected productSmartLife | Published09/20/2026 | SeverityHigh |
CVE-2026-86552A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP | Exploitation statusNot known exploited | FixNot confirmed | Affected productSmartLife | Published09/20/2026 | SeverityMedium |
CVE-2026-86551Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product | Exploitation statusNot known exploited | FixNot confirmed | Affected productNX741J | Published09/20/2026 | SeverityLow |
CVE-2026-86550UXSS vulnerability in ZTE browser products | Exploitation statusNot known exploited | FixNot confirmed | Affected productNebulaOS | Published09/08/2026 | SeverityMedium |
CVE-2026-49003Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXDU68 S202 V5.0 | Published08/31/2026 | SeverityCritical |
CVE-2026-9668SQL injection vulnerability in ZTE SCP product | Exploitation statusNot known exploited | FixNot confirmed | Affected productSCP | Published08/26/2026 | SeverityMedium |
CVE-2026-49008Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product | Exploitation statusNot known exploited | FixNot confirmed | Affected productF689 | Published08/07/2026 | SeverityMedium |
CVE-2026-49007Information leakage vulnerability in ZTE F689 product | Exploitation statusNot known exploited | FixNot confirmed | Affected productF689 | Published08/07/2026 | SeverityHigh |
CVE-2026-49006TLS credential leakage vulnerability in ZTE F689 product | Exploitation statusNot known exploited | FixNot confirmed | Affected productF689 | Published08/07/2026 | SeverityMedium |
CVE-2026-49005Root password hash exposure vulnerability in ZTE F689 product | Exploitation statusNot known exploited | FixNot confirmed | Affected productF689 | Published08/07/2026 | SeverityLow |
CVE-2026-8029SQL Injection Vulnerability in ZTE SmartLife App | Exploitation statusNot known exploited | FixNot confirmed | Affected productSmartLife | Published08/05/2026 | SeverityLow |
CVE-2026-49004PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product | Exploitation statusNot known exploited | FixNot confirmed | Affected productNX799J (Red Magic 11 Air) | Published08/05/2026 | SeverityMedium |
CVE-2026-40000Path Traversal Vulnerability in ZTE Blade A75 5G | Exploitation statusNot known exploited | FixNot confirmed | Affected productBlade A75 5G | Published07/27/2026 | SeverityLow |
CVE-2026-49002Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXUniPOS NDS-LTE | Published05/27/2026 | SeverityCritical |
CVE-2026-49001Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXUniPOS NDS-LTE | Published05/27/2026 | SeverityMedium |
CVE-2026-49000Cryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE product | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXUniPOS NDS-LTE | Published05/27/2026 | SeverityHigh |
CVE-2026-48999Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXUniPOS NDS-LTE | Published05/27/2026 | SeverityMedium |
CVE-2026-44410Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXUniPOS NDS-LTE | Published05/26/2026 | SeverityLow |
CVE-2026-44409Information disclosure vulnerability in ZTE MU5250 | Exploitation statusNot known exploited | FixNot confirmed | Affected productMU5250 | Published05/22/2026 | SeverityMedium |
CVE-2026-44408Unauthorized access vulnerability in ZTE MU5250 | Exploitation statusNot known exploited | FixNot confirmed | Affected productMU5250 | Published05/19/2026 | SeverityMedium |
CVE-2026-44407Remote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartview | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXCLOUD iRAI | Published05/07/2026 | SeverityMedium |
CVE-2026-44406DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXCLOUD iRAI | Published05/07/2026 | SeverityMedium |
CVE-2026-40004openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXCLOUD iRAI | Published05/07/2026 | SeverityMedium |
CVE-2026-40003USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM | Exploitation statusNot known exploited | FixNot confirmed | Affected productZX297520V3 BootROM | Published05/07/2026 | SeverityMedium |
CVE-2026-40001Local privilege escalation vulnerability in ZTE PROCESS Guard service of the cloud computer client | Exploitation statusNot known exploited | FixNot confirmed | Affected productZTE PROCESS Guard service | Published05/06/2026 | SeverityMedium |
CVE-2026-40002ZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. | Exploitation statusNot known exploited | FixYes | Affected productRed Magic 11 Pro (NX809J) | Published04/17/2026 | SeverityMedium |
CVE-2026-40436ZTE ZXEDM iEMS product has a password reset vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXEDM iEMS | Published04/13/2026 | SeverityHigh |
CVE-2025-66315ZTE MF258K Pro Version Server has a Configuration Defect Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productMF258K | Published01/09/2026 | SeverityMedium |
CVE-2025-66314 | Exploitation statusNot known exploited | FixYes | Affected productElasticNet UME R32 | Published11/27/2025 | SeverityHigh |
CVE-2025-46583DOS Vulnerability in ZTE MC889A Pro product | Exploitation statusNot known exploited | FixNot confirmed | Affected productMC889A Pro | Published10/27/2025 | SeverityMedium |
CVE-2025-46582Private Key Disclosure Vulnerability in ZTE ZXMP M721 Product | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXMP M721 | Published10/27/2025 | SeverityHigh |
CVE-2025-46581ZTE ZXCDN product has a Struts RCE Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXCDN | Published10/14/2025 | SeverityCritical |
CVE-2025-26711 | Exploitation statusNot known exploited | FixNot confirmed | Affected productT5400 | Published09/16/2025 | SeverityMedium |
CVE-2025-26710 | Exploitation statusNot known exploited | FixNot confirmed | Affected productT5400 | Published09/16/2025 | SeverityLow |
CVE-2025-26709Unauthorized Access Vulnerability in ZTE F50 | Exploitation statusNot known exploited | FixNot confirmed | Affected productF50 | Published08/15/2025 | SeverityMedium |
CVE-2025-46580ZTE GoldenDB Database product has a code-related vulnerability | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published04/27/2025 | SeverityHigh |
CVE-2025-46579ZTE GoldenDB Database product has a DDE injection vulnerability | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published04/27/2025 | SeverityHigh |
CVE-2025-46578ZTE GoldenDB Database product has SQL injection vulnerabilities in multiple interfaces | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published04/27/2025 | SeverityMedium |
CVE-2025-46577ZTE GoldenDB Database product has an SQL injection vulnerability | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published04/27/2025 | SeverityMedium |
CVE-2025-46576ZTE GoldenDB Database product has a privilege escalation vulnerability | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published04/27/2025 | SeverityMedium |
CVE-2025-46575ZTE GoldenDB Database product has an information disclosure vulnerability | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published04/27/2025 | SeverityMedium |
CVE-2025-46574ZTE GoldenDB Database product has an input validation vulnerability | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published04/27/2025 | SeverityMedium |
CVE-2025-26702 | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published03/11/2025 | SeverityMedium |
CVE-2025-26703 | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published03/11/2025 | SeverityMedium |
CVE-2025-26704 | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published03/11/2025 | SeverityMedium |
CVE-2025-26705 | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published03/11/2025 | SeverityMedium |
CVE-2025-26706 | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published03/11/2025 | SeverityMedium |
CVE-2025-26707 | Exploitation statusNot known exploited | FixYes | Affected productGoldenDB | Published03/11/2025 | SeverityMedium |
CVE-2025-26708ZTELink has a configuration defect vulnerability | Exploitation statusNot known exploited | FixYes | Affected productZTE Link | Published03/07/2025 | SeverityMedium |
CVE-2024-22063ZTE ZENIC ONE R58 product has a CSV injection vulnerability | Exploitation statusNot known exploited | FixYes | Affected productZENIC ONE R58 | Published12/30/2024 | SeverityHigh |
CVE-2024-22067ZTE NH8091 product has an improper permission control vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productNH8091 | Published11/18/2024 | SeverityMedium |
CVE-2024-22066 | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXR10 1800-2S | Published10/29/2024 | SeverityHigh |
CVE-2024-22065ZTE MF258 Pro product has a OS Command injection vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productMF258 Pro | Published10/29/2024 | SeverityMedium |
CVE-2024-22068Weak Password Vulnerability in ZTE ZSR V2 Intelligent Multi Service Router | Exploitation statusNot known exploited | FixNot confirmed | Affected productZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series | Published10/10/2024 | SeverityMedium |
CVE-2022-39068Buffer Overflow Vulnerability in ZTE MF296R | Exploitation statusNot known exploited | FixYes | Affected productMF296R | Published09/18/2024 | SeverityMedium |
CVE-2024-45415 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/16/2024 | SeverityCritical |
CVE-2024-45416 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/16/2024 | SeverityHigh |
CVE-2024-45413 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/16/2024 | SeverityHigh |
CVE-2024-45414 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/16/2024 | SeverityCritical |
CVE-2024-22069Permission and Access Control Vulnerability in ZXV10 XT802/ET301 | Exploitation statusNot known exploited | FixYes | Affected productZXV10 XT802 | Published08/08/2024 | SeverityHigh |
CVE-2024-22062Permissions and Access Control Vulnerability in ZTE ZXCLOUD IRAI | Exploitation statusNot known exploited | FixYes | Affected productZXCLOUD iRAI | Published07/09/2024 | SeverityMedium |
CVE-2023-25646Permission and Access Control Vulnerability in ZTE H388X | Exploitation statusNot known exploited | FixYes | Affected productZXHN H388X | Published06/20/2024 | SeverityHigh |
CVE-2024-22064Configuration error Vulnerability in ZTE ZXUN-ePDG | Exploitation statusNot known exploited | FixYes | Affected productZXUN-ePDG | Published05/10/2024 | SeverityHigh |
CVE-2023-41781XSS Vulnerability in ZTE MF258 Products | Exploitation statusNot known exploited | FixYes | Affected productMF258 | Published01/10/2024 | SeverityMedium |
CVE-2023-41782DLL Hijacking Vulnerability in ZTE ZXCLOUD iRAI | Exploitation statusNot known exploited | FixYes | Affected productZXCLOUD iRAI | Published01/05/2024 | SeverityLow |
CVE-2023-41784Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro | Exploitation statusNot known exploited | FixYes | Affected productRed Magic 8 Pro | Published01/04/2024 | SeverityMedium |
CVE-2023-41783Command Injection Vulnerability of ZTE's ZXCLOUD iRAI | Exploitation statusNot known exploited | FixYes | Affected productZXCLOUD iRAI | Published01/03/2024 | SeverityMedium |
CVE-2023-41776Local Privilege Escalation Vulnerability of ZTE's ZXCLOUD iRAI | Exploitation statusNot known exploited | FixYes | Affected productZXCLOUD iRAI | Published01/03/2024 | SeverityMedium |
CVE-2023-41780Unsafe DLL Loading Vulnerability in ZTE ZXCLOUD iRAI | Exploitation statusNot known exploited | FixYes | Affected productZXCLOUD iRAI | Published01/03/2024 | SeverityMedium |
CVE-2023-41779Illegal Memory Access Vulnerability of ZTE's ZXCLOUD iRAI | Exploitation statusNot known exploited | FixYes | Affected productZXCLOUD iRAI | Published01/03/2024 | SeverityMedium |
CVE-2023-25644Denial of Service Vulnerability in Some ZTE Mobile Internet Products | Exploitation statusNot known exploited | FixYes | Affected productMC801A | Published12/14/2023 | SeverityMedium |
CVE-2023-25643Two Vulnerabilities in Some ZTE Mobile Internet Products | Exploitation statusNot known exploited | FixYes | Affected productMC801A | Published12/14/2023 | SeverityHigh |
CVE-2023-25642Two Vulnerabilities in Some ZTE Mobile Internet Products | Exploitation statusNot confirmed | FixYes | Affected productMC801A | Published12/14/2023 | SeverityMedium |
CVE-2023-25651SQL Injection Vulnerability in Some ZTE Mobile Internet Products | Exploitation statusNot confirmed | FixYes | Affected productMobile Internet Products | Published12/14/2023 | SeverityMedium |
CVE-2023-25650Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI | Exploitation statusNot confirmed | FixYes | Affected productZXCLOUD iRAI | Published12/14/2023 | SeverityMedium |
CVE-2023-25648Weak Folder Permission Vulnerability in ZTE ZXCLOUD iRAI | Exploitation statusNot confirmed | FixYes | Affected productZXCLOUD iRAI | Published12/14/2023 | SeverityMedium |
CVE-2023-25649OS Command Injection Vulnerability in a Mobile Internet Product of ZTE | Exploitation statusNot known exploited | FixYes | Affected productMF286R | Published08/25/2023 | SeverityMedium |
CVE-2023-25647Permission and Access Control Vulnerability in Some ZTE Mobile Phones | Exploitation statusNot known exploited | FixYes | Affected productSome ZTE Mobile Phones | Published08/17/2023 | SeverityMedium |
CVE-2022-39069 | Exploitation statusNot known exploited | FixNot confirmed | Affected productZAIP-AIE | Published11/08/2022 | SeverityMedium |
CVE-2021-21750 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXIN10 CMS | Published12/27/2021 | SeverityUnknown |
CVE-2021-21751 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXIN10 CMS | Published12/27/2021 | SeverityUnknown |
CVE-2021-21742 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZTE Axon 30 Pro Message Service App | Published09/24/2021 | SeverityUnknown |
CVE-2021-21733 | Exploitation statusNot confirmed | FixNot confirmed | Affected product<ZXCDN V7.01> | Published05/19/2021 | SeverityUnknown |
CVE-2020-6876 | Exploitation statusNot confirmed | FixNot confirmed | Affected producteVDC | Published10/26/2020 | SeverityUnknown |
CVE-2020-6870 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNetNumenU31R20 | Published06/24/2020 | SeverityUnknown |
CVE-2020-6869 | Exploitation statusNot confirmed | FixNot confirmed | Affected product<ZTEMarket APK> | Published06/17/2020 | SeverityUnknown |
CVE-2020-12695 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/08/2020 | SeverityUnknown |
CVE-2020-6865 | Exploitation statusNot confirmed | FixNot confirmed | Affected productOSCP | Published04/30/2020 | SeverityUnknown |
CVE-2020-6867 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZENIC ONE R22b | Published04/30/2020 | SeverityUnknown |
CVE-2019-3431 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXCLOUD GoldenData VAP | Published12/23/2019 | SeverityUnknown |
CVE-2019-3430 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXCLOUD GoldenData VAP | Published12/23/2019 | SeverityUnknown |
CVE-2019-3429 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXCLOUD GoldenData VAP | Published12/23/2019 | SeverityUnknown |
CVE-2019-3428 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXCDN IAMWEB | Published11/22/2019 | SeverityUnknown |
CVE-2019-3427 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXCDN IAMWEB | Published11/22/2019 | SeverityUnknown |
CVE-2019-3422 | Exploitation statusNot confirmed | FixNot confirmed | Affected productMF910S | Published11/07/2019 | SeverityUnknown |
CVE-2019-3416 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXV10 B860A | Published09/23/2019 | SeverityHigh |
CVE-2019-3418 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZXHN F670 | Published08/15/2019 | SeverityMedium |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
.svg){kind=icon}
