Skip to content
Fencer Intel
low 3.3

CVE-2022-39074 json

There is an unauthorized access vulnerability in some ZTE mobile phones.

published 3y ago modified 4mo ago also EUVD-2022-41620

cvss
3.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could start a non-public interface of an application without user permission.

Patch / fix

  • zte blade_a52_firmware m02
  • zte blade_a51_firmware m07
  • zte blade_a3_lite_firmware m09
  • zte blade_a5_2020_firmware m05
  • zte blade_l210_firmware 1.14
  • zte blade_a7s_firmware 2.2
  • zte blade_a31_firmware m03
  • zte blade_a31_plus_firmware m04
  • zte blade_a5_2019_firmware m13
  • zte blade_a71_firmware 2.4
  • zte blade_a72_firmware 11.0.3
  • zte blade_v20_smart_firmware 1.14
  • zte blade_v30_firmware 1.11
  • zte blade_v30_vita_firmware 1.11
  • zte v40_pro_firmware 11.0.4_9046
  • zte blade_v40_vita_firmware 11.0.2_8045
  • zte axon_40_ultra_firmware 1.0.0b26

Is CVE-2022-39074 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

  • n/a ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.