Medium severity · published May 7, 2026
CVE-2026-40003
USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZB
ZX297520V3 BootROM · ZTE
7520V3 chip · source: vendor
ZF
Zx297520v3 Firmware · Zte
All versions, or not specified · source: NVD