CVE-2026-40003

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.

CVSS v3 5.1 MEDIUM

5.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.4 / Impact : 4.7

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2144487415169560645	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:zte:zx297520v3_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zte:zx297520v3:-:*:*:*:*:*:*:*

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El BootROM de ZTE ZX297520V3 contiene una vulnerabilidad que permite escrituras de memoria arbitrarias a través de USB. Los atacantes pueden explotar la falta de validación de la dirección de destino en el modo de descarga USB para escribir datos en cualquier ubicación de la memoria de tiempo de ejecución del BootROM, sobrescribiendo así la pila, secuestrando el flujo de ejecución, eludiendo el mecanismo de verificación de firma de Secure Boot y logrando la ejecución de código no autorizada.

Information

Published : 2026-05-07 02:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-40003

Mitre link : CVE-2026-40003

CVE.ORG link : CVE-2026-40003

JSON object : View

Products Affected

zte

zx297520v3_firmware
zx297520v3

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-40003", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40003", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T13:04:46.979027Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@zte.com.cn", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 0.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "affected": [{"source": "psirt@zte.com.cn", "affectedData": [{"vendor": "ZTE", "product": "ZX297520V3 BootROM", "versions": [{"status": "affected", "version": "7520V3 chip"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T02:16:03.453", "references": [{"url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2144487415169560645", "tags": ["Vendor Advisory"], "source": "psirt@zte.com.cn"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@zte.com.cn", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution."}, {"lang": "es", "value": "El BootROM de ZTE ZX297520V3 contiene una vulnerabilidad que permite escrituras de memoria arbitrarias a trav\u00e9s de USB. Los atacantes pueden explotar la falta de validaci\u00f3n de la direcci\u00f3n de destino en el modo de descarga USB para escribir datos en cualquier ubicaci\u00f3n de la memoria de tiempo de ejecuci\u00f3n del BootROM, sobrescribiendo as\u00ed la pila, secuestrando el flujo de ejecuci\u00f3n, eludiendo el mecanismo de verificaci\u00f3n de firma de Secure Boot y logrando la ejecuci\u00f3n de c\u00f3digo no autorizada."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zte:zx297520v3_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E69F8B0-75E7-4BD9-A4C7-4F3CF428CEE7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zte:zx297520v3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B664C83E-0249-47BB-A3AD-1E9C4DF34206"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@zte.com.cn"}