# Zte vulnerabilities Source: https://junglewise.ai/threats/vendors/zte Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/zte.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in Zte: 0 in the last 7 days and 12 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118871, was published on 2 November 2026. 1 vulnerability in the last four weeks, down 87% on the four before (8). 3 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 12 - All time: 22 (2 critical, 0 exploited in the wild) ## About Zte A global provider of telecommunications equipment, network solutions, and mobile devices. ## Latest Zte vulnerabilities - [CVE-2026-118871: ZTE ICCP SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-118871-sql-injection-vulnerability-classified-as-an-internal-threat) (medium, CVSS 6.5, published 2 Nov 2026) - [CVE-2026-108506: ZTE Z80 Ultra inadequate system interface authentication](https://junglewise.ai/threats/cve-2026-108506-zte-z80-ultra-s-system-interfaces-do-not-have-robust-invocation) (medium, CVSS 5.5, published 10 Oct 2026) - [CVE-2026-108504: ZTE Z80 Ultra insufficient access control in framework methods](https://junglewise.ai/threats/cve-2026-108504-zte-z80-ultra-has-an-unauthorized-information-disclosure) (medium, CVSS 5.5, published 10 Oct 2026) - [CVE-2026-108501: ZTE Z80 Ultra interface access control defect](https://junglewise.ai/threats/cve-2026-108501-zte-z80-ultra-has-a-system-interface-permission-verification) (medium, CVSS 5.7, published 10 Oct 2026) - [CVE-2026-86556: ZTE U30 Air information disclosure in permission control](https://junglewise.ai/threats/cve-2026-86556-there-is-an-information-disclosure-vulnerability-in-zte-u30-air) (medium, CVSS 5.3, published 30 Sep 2026) - [CVE-2026-86555: ZTE SmartLife hardcoded encryption key in account credentials](https://junglewise.ai/threats/cve-2026-86555-the-zte-smartlife-application-has-a-hardcoded-key-the-key-used-to) (medium, CVSS 6.2, published 20 Sep 2026) - [CVE-2026-86554: ZTE SmartLife app account enumeration via exposed credentials](https://junglewise.ai/threats/cve-2026-86554-smartlife-app-dynamically-generates-brand-new-smartlife) (medium, CVSS 4.3, published 20 Sep 2026) - [CVE-2026-86553: ZTE SmartLife app authentication bypass in account verification](https://junglewise.ai/threats/cve-2026-86553-smartlife-app-dynamically-generates-fresh-smartlife-application) (high, CVSS 8.8, published 20 Sep 2026) - [CVE-2026-86552: ZTE SmartLife authentication bypass in account registration](https://junglewise.ai/threats/cve-2026-86552-smartlife-app-dynamically-generates-brand-new-smartlife) (medium, CVSS 5.4, published 20 Sep 2026) - [CVE-2026-86550: NuBrowser UXSS in intent:// protocol handler](https://junglewise.ai/threats/cve-2026-86550-nubrowser-uxss-in-intent-protocol-handler) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-49003: ZTE monitoring module command injection](https://junglewise.ai/threats/cve-2026-49003-zte-monitoring-module-command-injection) (critical, CVSS 9.6, published 31 Aug 2026) - [CVE-2026-9668: ZTE ICCP SQL injection authentication bypass](https://junglewise.ai/threats/cve-2026-9668-zte-iccp-sql-injection-authentication-bypass) (medium, CVSS 6.3, published 26 Aug 2026) - [CVE-2026-49002: ZTE improper access control in system configuration](https://junglewise.ai/threats/cve-2026-49002-zte-improper-access-control-in-system-configuration) (critical, CVSS 9.1, published 27 May 2026) - [CVE-2026-49001: ZTE Products Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2026-49001-zte-products-cross-site-request-forgery) (medium, CVSS 5.3, published 27 May 2026) - [CVE-2026-44409: ZTE MU5250 information disclosure due to improper access control](https://junglewise.ai/threats/cve-2026-44409-zte-mu5250-information-disclosure-due-to-improper-access-control) (medium, CVSS 5.7, published 22 May 2026) - [CVE-2026-44408: ZTE MU5250 unauthorized access in web interface](https://junglewise.ai/threats/cve-2026-44408-zte-mu5250-unauthorized-access-in-web-interface) (medium, CVSS 6.3, published 19 May 2026) - [CVE-2026-44407: ZTE uSmartview format string vulnerability in Cloud PC client](https://junglewise.ai/threats/cve-2026-44407-zte-usmartview-format-string-vulnerability-in-cloud-pc-client) (medium, CVSS 4.7, published 7 May 2026) - [CVE-2026-44406: ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with…](https://junglewise.ai/threats/cve-2026-44406-zte-cloud-pc-client-usmartview-contains-a-dll-hijacking) (medium, CVSS 5.7, published 7 May 2026) - [CVE-2026-40004: ZTE uSmartview privilege escalation via openssl.cnf search path](https://junglewise.ai/threats/cve-2026-40004-zte-usmartview-privilege-escalation-via-openssl-cnf-search-path) (medium, CVSS 5.5, published 7 May 2026) - [CVE-2026-40003: ZTE ZX297520V3 arbitrary memory write in BootROM](https://junglewise.ai/threats/cve-2026-40003-zte-zx297520v3-arbitrary-memory-write-in-bootrom) (medium, CVSS 5.1, published 7 May 2026) - [CVE-2026-40002: ZTE Red Magic 11 Pro improper privilege management in service interface](https://junglewise.ai/threats/cve-2026-40002-zte-red-magic-11-pro-improper-privilege-management-in-service) (medium, CVSS 5, published 17 Apr 2026) - [CVE-2026-40436: ZTE ZXEDM iEMS password reset vulnerability in cloud EMS portal](https://junglewise.ai/threats/cve-2026-40436-zte-zxedm-iems-password-reset-vulnerability-in-cloud-ems-portal) (high, CVSS 7.1, published 13 Apr 2026) ## Most severe Zte vulnerabilities - [CVE-2026-49003: ZTE monitoring module command injection](https://junglewise.ai/threats/cve-2026-49003-zte-monitoring-module-command-injection) (critical, CVSS 9.6, published 31 Aug 2026) - [CVE-2026-49002: ZTE improper access control in system configuration](https://junglewise.ai/threats/cve-2026-49002-zte-improper-access-control-in-system-configuration) (critical, CVSS 9.1, published 27 May 2026) - [CVE-2026-86553: ZTE SmartLife app authentication bypass in account verification](https://junglewise.ai/threats/cve-2026-86553-smartlife-app-dynamically-generates-fresh-smartlife-application) (high, CVSS 8.8, published 20 Sep 2026) - [CVE-2026-40436: ZTE ZXEDM iEMS password reset vulnerability in cloud EMS portal](https://junglewise.ai/threats/cve-2026-40436-zte-zxedm-iems-password-reset-vulnerability-in-cloud-ems-portal) (high, CVSS 7.1, published 13 Apr 2026) - [CVE-2026-86550: NuBrowser UXSS in intent:// protocol handler](https://junglewise.ai/threats/cve-2026-86550-nubrowser-uxss-in-intent-protocol-handler) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-118871: ZTE ICCP SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-118871-sql-injection-vulnerability-classified-as-an-internal-threat) (medium, CVSS 6.5, published 2 Nov 2026) - [CVE-2026-9668: ZTE ICCP SQL injection authentication bypass](https://junglewise.ai/threats/cve-2026-9668-zte-iccp-sql-injection-authentication-bypass) (medium, CVSS 6.3, published 26 Aug 2026) - [CVE-2026-44408: ZTE MU5250 unauthorized access in web interface](https://junglewise.ai/threats/cve-2026-44408-zte-mu5250-unauthorized-access-in-web-interface) (medium, CVSS 6.3, published 19 May 2026) - [CVE-2026-86555: ZTE SmartLife hardcoded encryption key in account credentials](https://junglewise.ai/threats/cve-2026-86555-the-zte-smartlife-application-has-a-hardcoded-key-the-key-used-to) (medium, CVSS 6.2, published 20 Sep 2026) - [CVE-2026-108501: ZTE Z80 Ultra interface access control defect](https://junglewise.ai/threats/cve-2026-108501-zte-z80-ultra-has-a-system-interface-permission-verification) (medium, CVSS 5.7, published 10 Oct 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 87% on the four before (8). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 1 | 1 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Zte technologies - [Zte SmartLife](https://junglewise.ai/threats/technologies/zte-smartlife): 4 vulnerabilities - [Zte Z80 Ultra](https://junglewise.ai/threats/technologies/z80-ultra): 3 vulnerabilities - [Zte Zxcloud Irai](https://junglewise.ai/threats/technologies/zxcloud-irai): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Zte vulnerabilities", https://junglewise.ai/threats/vendors/zte, 10 November 2026.