CVE-2025-46581

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-465827.7A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the CVE-2025-465835.3There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the CVE-2025-465845.5Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerabilitCVE-2025-465857.0Out-of-bounds array read/write vulnerability in the kernel module Impact: Successful exploitation of this vulnerability may affect availabilCVE-2025-465865.5Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-465875.5Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidCVE-2025-465887.7Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and CVE-2025-465897.1Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and CVE-2025-46595.3The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full PaCVE-2025-465906.5Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypasCVE-2025-465915.5Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service cCVE-2025-465925.5Null pointer dereference vulnerability in the USB HDI driver module Impact: Successful exploitation of this vulnerability may affect availab
CVE-2025-46581: Critical severity, CVSS 9.8 | Vulnix