CVE-2025-46579: ZTE GoldenDB Database product has a DDE injection vulnerability

High severity · published Apr 27, 2025

CVE-2025-46579

ZTE GoldenDB Database product has a DDE injection vulnerability

7.8

CVSS

0.3%

EPSS

On KEV

Description

There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download and open the affected file, the DDE commands can be executed.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 25% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

GoldenDB · ZTE

6.1.03 through 6.1.03.10; 7.2.01.01; Lite7.2.01.01 · source: vendor

Zxcloud Goldendb · Zte

6.1.03 before 6.1.03.11; 7.2.01.01; 7.2.01.01 · source: NVD

Affected product

GoldenDB

ZTE

All GoldenDB CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-46579

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-46579

Vendor Advisory

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1036467615091601474