Local privilege escalation vulnerability in ZTE PROCESS Guard service of the cloud computer client

There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass.

Problem type

CWE-269: Improper Privilege Management

Affected products

ZTE

ZTE PROCESS Guard service

ZXCLOUD-iRAI-ClientV7.2X - AFFECTED

References

support.zte.com.cn

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1477954674427011121

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-40001

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-40001",
    "assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb",
    "assignerShortName": "zte",
    "dateUpdated": "2026-05-06T08:48:10.466Z",
    "dateReserved": "2026-04-08T07:51:26.675Z",
    "datePublished": "2026-05-06T08:48:10.466Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "6786b568-6808-4982-b61f-398b0d9679eb",
        "shortName": "zte",
        "dateUpdated": "2026-05-06T08:48:10.466Z"
      },
      "title": "Local privilege escalation vulnerability in ZTE PROCESS Guard service of the cloud computer client",
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass.",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "<p>There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary code execution, privilege escalation and path traversal bypass.</p><p></p><p><br></p>"
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "ZTE",
          "product": "ZTE PROCESS Guard service",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "ZXCLOUD-iRAI-ClientV7.2X",
              "status": "affected"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-269: Improper Privilege Management",
              "cweId": "CWE-269",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1477954674427011121"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ],
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
            "attackVector": "LOCAL",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "CHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "availabilityImpact": "LOW",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Runzi Zhao、Feng Ye、Ziwei Wang",
          "type": "finder"
        }
      ]
    }
  }
}