Skip to content
Fencer Vulns
high 7.1

CVE-2022-39071 json

There is an unauthorized access vulnerability in some ZTE mobile phones.

published 2023-05-30 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-41617

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission.

Patch / fix

  • zte blade_a52_firmware m02
  • zte blade_a51_firmware m07
  • zte blade_a3_lite_firmware m09
  • zte blade_a5_2020_firmware m05
  • zte blade_l210_firmware 1.14
  • zte blade_a7s_firmware 2.2
  • zte blade_a31_firmware m03
  • zte blade_a31_plus_firmware m04
  • zte blade_a5_2019_firmware m13
  • zte blade_a71_firmware 2.4
  • zte blade_a72_firmware 11.0.3
  • zte blade_v20_smart_firmware 1.14
  • zte blade_v30_firmware 1.11
  • zte blade_v30_vita_firmware 1.11
  • zte v40_pro_firmware 11.0.4_9046
  • zte blade_v40_vita_firmware 11.0.2_8045
  • zte axon_40_ultra_firmware 1.0.0b26

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected products

  • n/a ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.