CVE-2026-40003

CVE-2026-40003、通称Joselitoは、ZXIC/Sanechips ZX297520V3 SoC BootROMで発見された任意メモリ書き込みの脆弱性です。 !CAUTION このPoCは研究目的のみで公開されています。このエクスプロイトを悪意のある目的で使用してはいけません 。所有していないデバイスや、所有者の明示的な同意なしにエクスプロイトを使用してはいけません 。 ステータス この脆弱性は2026年3月以降の新しいSoCリビジョンで修正される予定です。パッチ適用済みチップを使用した既知の製品はまだありません。既存のすべてのデバイスが脆弱です。 どのように動作するのか...

Exploit for CVE-2026-40003

CVE-2026-40003 aka Joselito is arbitrary memory write vulnerabil...

CVE-2026-40003

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

CVE-2026-40003

CVE-2026-40003 describes a USB-based arbitrary memory write vulnerability in the ZTE ZX297520V3 BootROM. The issue arises from lack of target address validation in the USB download mode, allowing writes to arbitrary locations in BootROM runtime memory. Potential consequences, as stated, include o...

CVE-2026-40003 USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

CVE-2026-40003: Out-of-bounds Write

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

ZTE ZX297520V3 缓冲区错误漏洞

ZTE ZX297520V3 is an industrial-grade 4G module from ZTE Corporation. The ZTE ZX297520V3 has a buffer error vulnerability. This vulnerability stems from the lack of target address verification in the USB download mode, which may allow arbitrary memory writes. As a result, it can overwrite the...

PT-2026-38322

Name of the Vulnerable Software and Affected Versions ZTE ZX297520V3 affected versions not specified Description The BootROM contains an issue allowing arbitrary memory writes via USB. Due to a lack of target address validation in the USB download mode, it is possible to write data to any locatio...

EUVD-2019-13060

Malware in sbrugna...

CVE-2019-3421

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...

CVE-2019-3421

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...

CVE-2019-3421

The vulnerability CVE-2019-3421 affects the ZTE ZX297520V3 platform (7520V3V1.0.0B09P27 and earlier) and is described as a Command Injection that could let unauthorized users take control of the user terminal system. The CVEs and related records (NVD, Red Hat, prion listing) confirm affected prod...

CVE-2019-3421: Improper Neutralization of Special Elements used in a Command

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...

PT-2019-16573

Name of the Vulnerable Software and Affected Versions ZTE ZX297520V3 version 7520V3V1.0.0B09P27 and earlier Description The issue allows unauthorized users to exploit a Command Injection vulnerability, potentially giving them control over the user terminal system. Recommendations For version...