CVE-2023-25647: Permission and Access Control Vulnerability in Some ZTE Mobile Phones

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-17 · updated 2026-06-17
Weakness: CWE-269

Description

There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.

Affected products

ZTE Axon 30 Firmware: before 3.0.0b06 — fixed in 3.0.0b06
ZTE Axon 40 Pro Firmware: before 1.0.0b16 — fixed in 1.0.0b16
ZTE Axon 40 Ultra Firmware: before 2.0.0b17 — fixed in 2.0.0b17
ZTE Nubia Z50 Firmware: before 1.0.0b19mr — fixed in 1.0.0b19mr

How to fix

Upgrade to a fixed version: ZTE Axon 30 Firmware 3.0.0b06; ZTE Axon 40 Pro Firmware 1.0.0b16; ZTE Axon 40 Ultra Firmware 2.0.0b17; ZTE Nubia Z50 Firmware 1.0.0b19mr. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-25647 or the next vulnerability affects your stack