CVE-2026-40003 json
USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM
published 6mo ago modified 14d ago also EUVD-2026-28232
- cvss
- 5.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
Is CVE-2026-40003 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.1 | CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L |
| NVD | 3.1 | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- ZTE ZX297520V3 BootROM
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
Sources
- CVE List CVE-2026-40003
- NVD CVE-2026-40003
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.