CVE-2026-40004
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
There is an openssl.cnf privilege escalation vulnerability in the ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.
Risk Assessment
A local attacker can gain higher privileges on the system, potentially leading to full compromise of the workstation.
Recommendation
Update the uSmartview client to a patched version and restrict the ability to load untrusted OpenSSL configuration files locally.
Other vulnerabilities in ZTE uSmartview
See all- CVE-2026-44407Medium
A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service. The description does not provide technical details or affected versions.
- CVE-2026-44406Medium
ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability. Since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.
Original NVD description (English source)
There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS