CVE-2023-41780: Unsafe DLL Loading Vulnerability in ZTE ZXCLOUD iRAI

Description

There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges.

Scores

CVSS scores of CVE-2023-41780, by who scored it
Scored by	CVSS	Score	Vector
zteCNA (assigner)	3.1	Medium6.4	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.22% · top 87% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs
CWE-427 (opens in a new tab)All about CWE-427 and its CVEs

Affected products

ZTE · ZXCLOUD iRAI
- affected All versions up to 7.23.23 – ≤ 7.23.23

What to do

Solution: 7.23.32

References (1)

https://https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-41780](https://trackcve.app/badge/CVE-2023-41780.svg)](https://trackcve.app/cve/CVE-2023-41780)

Record last updated 6 Sept 2024, 17:48 UTC.