CVE-2022-39075: There is an unauthorized access vulnerability in some ZTE mobile phones

High severity · published May 30, 2023

CVE-2022-39075

There is an unauthorized access vulnerability in some ZTE mobile phones

7.1

CVSS

0.3%

EPSS

On KEV

Description

There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system files without user permission.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 22% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra ·

All versions up to Z6356T_M01, All versions up to Blade A51_M06, All versions up to Blade A30_M08, All versions up to Blade A5 2020-T_M04, All versions up to GEN_MY_L210_V1.13, All versions up to CLA_GT_A7020_V2.1, All versions up to Blade A31_M02, All versions up to P600_M03, All versions up to P650 Pro_M12, All versions up to GEN_EU_EEA_A7030_V2.3, All versions up to MyOS11.0.2_A7039_CLA_CO, All versions up to TEL_MX_ZTE_8010V1.13, All versions up to TEL_MX_ZTE_9030V1.10, All versions up to TEL_MX_ZTE_8030V1.10, All versions up to MyOS11.0.3_9045_TEL All versions up to MyOS11.0.1_8044_CLA_CO, All versions up to NON_EEA_P898F01V1.0.0B25 · source: vendor

Axon 40 Ultra Firmware · Zte

before 1.0.0b26 · source: NVD

Blade A3 Lite Firmware · Zte

before m09 · source: NVD

Blade A31 Firmware · Zte

before m03 · source: NVD

Blade A31 Plus Firmware · Zte

before m04 · source: NVD

Blade A5 2019 Firmware · Zte

before m13 · source: NVD

Blade A5 2020 Firmware · Zte

before m05 · source: NVD

Blade A51 Firmware · Zte

before m07 · source: NVD

Blade A52 Firmware · Zte

before m02 · source: NVD

Blade A71 Firmware · Zte

before 2.4 · source: NVD

Blade A72 Firmware · Zte

before 11.0.3 · source: NVD

Blade A7s Firmware · Zte

before 2.2 · source: NVD

Affected product

All ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-39075

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-39075

Vendor Advisory

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1030664

More from ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra

7.1

CVE-2022-39071

There is an unauthorized access vulnerability in some ZTE mobile phones

3.3

CVE-2022-39074

There is an unauthorized access vulnerability in some ZTE mobile phones