CVE-2026-40003
USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM
- State
- Published
- Severity
- 5.1 Medium
- Published
- May 7, 2026
- Updated
- May 19, 2026
- Reserved
- Apr 8, 2026
Description
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.1 Medium | CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L | zte |
Weaknesses
- CWE-787 Out-of-bounds write
Affected Products
| Product | Versions |
|---|---|
ZX297520V3 BootROMZTE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.