CVE-2022-39071

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-30 · updated 2026-06-17

Description

There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission.

Affected products

ZTE Axon 40 Ultra Firmware: before 1.0.0b26 — fixed in 1.0.0b26
ZTE Blade A31 Firmware: before m03 — fixed in m03
ZTE Blade A31 Plus Firmware: before m04 — fixed in m04
ZTE Blade A3 Lite Firmware: before m09 — fixed in m09
ZTE Blade A51 Firmware: before m07 — fixed in m07
ZTE Blade A52 Firmware: before m02 — fixed in m02
ZTE Blade A5 2019 Firmware: before m13 — fixed in m13
ZTE Blade A5 2020 Firmware: before m05 — fixed in m05
ZTE Blade A71 Firmware: before 2.4 — fixed in 2.4
ZTE Blade A72 Firmware: before 11.0.3 — fixed in 11.0.3
ZTE Blade A7S Firmware: before 2.2 — fixed in 2.2
ZTE Blade L210 Firmware: before 1.14 — fixed in 1.14
ZTE Blade V20 Smart Firmware: before 1.14 — fixed in 1.14
ZTE Blade V30 Firmware: before 1.11 — fixed in 1.11
ZTE Blade V30 Vita Firmware: before 1.11 — fixed in 1.11
ZTE Blade V40 Vita Firmware: before 11.0.2_8045 — fixed in 11.0.2_8045
ZTE V40 Pro Firmware: before 11.0.4_9046 — fixed in 11.0.4_9046

How to fix

Upgrade to a fixed version: ZTE Axon 40 Ultra Firmware 1.0.0b26; ZTE Blade A31 Firmware m03; ZTE Blade A31 Plus Firmware m04; ZTE Blade A3 Lite Firmware m09; ZTE Blade A51 Firmware m07; ZTE Blade A52 Firmware m02; ZTE Blade A5 2019 Firmware m13; ZTE Blade A5 2020 Firmware m05; ZTE Blade A71 Firmware 2.4; ZTE Blade A72 Firmware 11.0.3; ZTE Blade A7S Firmware 2.2; ZTE Blade L210 Firmware 1.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-39071 or the next vulnerability affects your stack