CVE-2026-40003

CVE-2026-40003, 일명 Joselito는 ZXIC/Sanechips ZX297520V3 SoC BootROM에서 발견된 임의 메모리 쓰기 취약점입니다. !CAUTION 이 PoC는 연구 목적으로만 공개되었습니다. 이 익스플로잇을 악의적인 목적으로 사용해서는 안 됩니다. 소유하지 않은 기기나 소유자의 명시적 동의 없이 익스플로잇을 사용하지 마십시오. 상태 이 취약점은 2026년 3월 이후 최신 SoC 개정판에서 수정되었습니다. 패치된 칩을 사용하는 알려진 제품은 아직 없습니다. 기존의 모든 기기는 취약합니다. 어떻게...

Exploit for CVE-2026-40003

CVE-2026-40003 aka Joselito is arbitrary memory write vulnerabil...

CVE-2026-40003

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

CVE-2026-40003 USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

CVE-2026-40003

CVE-2026-40003 describes a USB-based arbitrary memory write vulnerability in the ZTE ZX297520V3 BootROM. The issue arises from lack of target address validation in the USB download mode, allowing writes to arbitrary locations in BootROM runtime memory. Potential consequences, as stated, include o...

PT-2026-38322

Name of the Vulnerable Software and Affected Versions ZTE ZX297520V3 affected versions not specified Description The BootROM contains an issue allowing arbitrary memory writes via USB. Due to a lack of target address validation in the USB download mode, it is possible to write data to any locatio...

CVE-2026-40003: Out-of-bounds Write

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

ZTE ZX297520V3 缓冲区错误漏洞

ZTE ZX297520V3 is an industrial-grade 4G module from ZTE Corporation. The ZTE ZX297520V3 has a buffer error vulnerability. This vulnerability stems from the lack of target address verification in the USB download mode, which may allow arbitrary memory writes. As a result, it can overwrite the...

EUVD-2019-13060

Malware in sbrugna...

CVE-2019-3421

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...

CVE-2019-3421

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...

CVE-2019-3421

The vulnerability CVE-2019-3421 affects the ZTE ZX297520V3 platform (7520V3V1.0.0B09P27 and earlier) and is described as a Command Injection that could let unauthorized users take control of the user terminal system. The CVEs and related records (NVD, Red Hat, prion listing) confirm affected prod...

PT-2019-16573

Name of the Vulnerable Software and Affected Versions ZTE ZX297520V3 version 7520V3V1.0.0B09P27 and earlier Description The issue allows unauthorized users to exploit a Command Injection vulnerability, potentially giving them control over the user terminal system. Recommendations For version...

CVE-2019-3421: Improper Neutralization of Special Elements used in a Command

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...