Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by zte

CVE-2026-49003Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product

Critical 9.6

In plain English

A critical-severity improper authentication in ZXDU68 S202 V5.0 from ZTE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)2.4%top 15.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tampering with critical system parameters and triggering abnormal operation of the entire power system.

Affected products (as reported)

VendorProductVersions
ZTE ZXDU68 S202 V5.0 ZXDU68 S202 V5.0R02M02 ACB V1.30.01.00 、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.01、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.02、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.03

Weakness: CWE-287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References