CVE Tools
Sign in

CVE-2026-40003

USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

Published: May 7, 2026Updated: May 13, 2026 Sources: CVE List NVDCWE-787
NVD MITRE
5.1CVSSMEDIUM
EPSS Score
0.3%
Top 79.0%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
Patch Available

Description

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.

CVSS Vector Breakdown

AV:PAC:HPR:NUI:RS:UC:LI:HA:L
Exploitability
AV:PAttack Vector
Physical
AC:HAttack Complexity
High
PR:NPrivileges Required
None
UI:RUser Interaction
Required
Scope
S:UScope
Unchanged
Impact
C:LConfidentiality
Low
I:HIntegrity
High
A:LAvailability
Low
Open in CVSS calculator →

Weaknesses

CWE-787

Affected Products

zx297520v3 firmwarezteNetworking Infrastructure
ZX297520V3 BootROMZTENetworking Infrastructure
ztecommercialCNNetworking Infrastructureaka zte corporation

Attack Graph

Products CVE Techniques Tactics

Click technique nodes to view MITRE ATT&CK details. Scroll to zoom, drag to pan.

Exploitability

Official Patch Available

MITRE ATT&CK

2 techniques
Initial Access
Privilege Escalation
View detailed technique mapping

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2144487415169560645
support.zte.com.cn

Timeline

Published
May 7, 2026
Last Updated
May 13, 2026

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-40003 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows