CRITICAL
CVE-2025-46581
CVSS
9.8
Description
ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges.
Summary dbcve.org
ZTE's ZXCDN product contains a Struts-based remote code execution vulnerability. An unauthenticated attacker can send specially crafted requests to the affected system to execute arbitrary commands with non-root privileges, potentially leading to full system compromise.
Mitigation
Apply vendor-supplied patches or upgrade ZXCDN to a fixed version. If no patch is available, restrict network access to the management interface and consider deploying a WAF with Struts attack signatures as a temporary compensating control.
Weakness (CWE)
CWE-94
Code Injection
EPSS Score
0.8%
Probability of exploitation in next 30 days
55.1th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.