CVE-2023-41780

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-427

Affected software

Vendor	Product	Versions
ZTE	ZXCLOUD iRAI	>= All versions up to 7.23.23, <= 7.23.23
zte	zxcloud_irai_firmware	< 7.23.23

References

https://https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404Broken Link, Vendor Advisory
https://https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404Broken Link, Vendor Advisory

Timeline

Published: Jan 3, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-417816.1There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS a CVE-2023-417824.8There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully CVE-2023-417837.8There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an at CVE-2023-417845.5Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro CVE-2023-417866.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability all CVE-2023-417877.5Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vu CVE-2023-417888.8Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained CVE-2023-417896.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site S CVE-2023-41799.8A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected is CVE-2023-417909.8Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vu CVE-2023-417915.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site S CVE-2023-417926.1Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascri