CVE-2026-49003— Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product
Quick assessment
Affected
ZTE ZXDU68 S202 V5.0
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
攻击者可利用命令注入漏洞删除系统核心运行时文件，导致监控模块崩溃并陷入瘫痪；同时，攻击者可获取 root 权限，窃取 SNMP 等配置密码，进而篡改关键系统参数，引发电力系统整体运行异常。
Possible ATT&CK Techniques 2 AI
T1548 · Abuse Elevation Control Mechanism T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ZTE | ZXDU68 S202 V5.0 | ZXDU68 S202 V5.0R02M02 ACB V1.30.01.00 、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.01、ZXDU68 S202 V5.0R02M0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49003
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product
Source: CVE Program / CVE List V5
Vulnerability Description
Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tampering with critical system parameters and triggering abnormal operation of the entire power system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ZTE | ZXDU68 S202 V5.0 | ZXDU68 S202 V5.0R02M02 ACB V1.30.01.00 、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.01、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.02、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.03 | - |
|
II. Public POCs for CVE-2026-49003
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49003
请登录查看更多情报信息。
Other References for CVE-2026-49003 (1)
IV. Related Vulnerabilities
Same vendor: ZTE
-
CVE-2026-9668
SQL injection vulnerability in ZTE SCP product -
CVE-2026-49008
Integrity‑check credential leakage vulnerability in an appli -
CVE-2026-49007
Information leakage vulnerability in ZTE F689 product -
CVE-2026-49006
TLS credential leakage vulnerability in ZTE F689 product -
CVE-2026-49005
Root password hash exposure vulnerability in ZTE F689 produc
Same weakness: CWE-287
-
CVE-2026-61641
Wallos: OIDC account takeover via email-based account linkin -
CVE-2026-54600
Wallos: Unauthenticated database replacement via import endp -
CVE-2026-82547
Linux Foundation Magma Registration Complete Message amf_fsm -
CVE-2026-75807
SAML Single Sign On <= 5.4.6 - Unauthenticated Authenticatio -
CVE-2026-82466
Rodauth before 2.46.0 Authentication Bypass via webauthn_log
V. Comments for CVE-2026-49003
No comments yet