CVE-2026-40003
USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
- Record
CVE-2026-40003- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-28232
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
- Record
EUVD-2026-28232- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2jfv-r29r-j6wr
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB....
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
- Record
GHSA-2jfv-r29r-j6wr- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
- Record
CVE-2026-40003- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L - CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | rva3/CVE-2026-40003 | 2026-05-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40003 is a medium vulnerability (CVSS 5.1) in Zte Zx297520v3 Bootrom, published May 7, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. No source names a fixed version.