What’s Vulnerable › Vulnerabilities

CVE-2023-25650: Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-14 · updated 2026-06-17
• Weakness: CWE-20

Description

There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads.

Affected products

• ZTE ZXCLOUD iRAI: before 7.23.30 — fixed in 7.23.30

How to fix

Upgrade to a fixed version: ZTE ZXCLOUD iRAI 7.23.30. Check the vendor advisory for mitigations.

References

• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032904
• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032904

Get alerted when CVE-2023-25650 or the next vulnerability affects your stack