CVE-2025-46581CWE-94code-injection

CVE-2025-46581

Critical · published October 14, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

🚨 A remote code execution vulnerability in ZTE's ZXCDN could let attackers run commands as if they were you! 🔥 Think of it like a hotel that allows any guest to stroll into the kitchen and start cooking without being checked in — chaos could ensue! 🍽️ An attacker could execute commands remotely without needing to authenticate, resulting in unauthorized access and potential data breach, which could be absolutely devastating for your systems. Imagine losing sensitive data or having your services manipulated — that’s a nightmare! 😱

Put simply

Think of it like a hotel that allows any guest to stroll into the kitchen and start cooking without being checked in — chaos could ensue! 🍽️ This vulnerability in the Struts framework allows unauthenticated attackers to execute arbitrary code with non-root privileges, making it a serious risk for any installation of the ZXCDN product.

What to do

An attacker could execute commands remotely without needing to authenticate, resulting in unauthorized access and potential data breach, which could be absolutely devastating for your systems. Imagine losing sensitive data or having your services manipulated — that’s a nightmare! 😱 Immediately apply security patches provided by ZTE to mitigate this risk. Review your systems for any potential exploit attempts and monitor logs for unusual activity. Ensure your overall security posture is robust by implementing network segmentation and intrusion detection systems. You've got this! By taking these steps, you can shield your systems from potential threats and keep everything running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00802 · 56.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-10-14T13:15Z
References (1)
EPSS history
Timeline
  • 14 OCT 08:54Z
    ZTE ZXCDN product has a Struts RCE Vulnerability
    cvelistv5