CVE-2023-25645

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-16 · updated 2026-06-17
Weakness: CWE-276

Description

There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation.

Affected products

ZTE Up T2 4K Firmware: v84511302.1427
ZTE Zxv10 B860H V5D0 Firmware: v83011303.0049, v83011303.0051, v83011303.0053, v83011303.0063, v83011303.0069
ZTE Zxv10 B866V2-H Firmware: v84711321.0038, v84711321.0040, v84711321.0045, v84711321.0049
ZTE Zxv10 B866V2 Firmware: v82811306.3021, v82815416.1027, v82815416.1028, v82815416.1029, v82815416.2012, v84711309.0016 (+2)
ZTE Zxv10 B866V2F Firmware: v86111338.0026, v86111338.0031, v86111338.0033, v86111338.0035

References

Get alerted when CVE-2023-25645 or the next vulnerability affects your stack