Vulnerability · Published May 7, 2026 · Assigned by zte

CVE-2026-44406DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview

Medium 5.7

In plain English

A medium-severity uncontrolled search path in ZXCLOUD iRAI from ZTE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)0.2%top 94.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.

Affected products (as reported)

Vendor	Product	Versions
ZTE	ZXCLOUD iRAI	ZXCLOUD-iRAI-ClientV7.2X

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/8107253322107965601