CVE-2022-39071: ZTE Axon 40 Ultra Firmware

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission.

Affected products

• ZTE Axon 40 Ultra Firmware: before 1.0.0b26 (fixed in 1.0.0b26)
• ZTE Blade a31 Firmware: before m03 (fixed in m03)
• ZTE Blade a31 Plus Firmware: before m04 (fixed in m04)
• ZTE Blade a3 Lite Firmware: before m09 (fixed in m09)
• ZTE Blade a51 Firmware: before m07 (fixed in m07)
• ZTE Blade a52 Firmware: before m02 (fixed in m02)
• ZTE Blade a5 2019 Firmware: before m13 (fixed in m13)
• ZTE Blade a5 2020 Firmware: before m05 (fixed in m05)
• ZTE Blade a71 Firmware: before 2.4 (fixed in 2.4)
• ZTE Blade a72 Firmware: before 11.0.3 (fixed in 11.0.3)
• ZTE Blade a7s Firmware: before 2.2 (fixed in 2.2)
• ZTE Blade l210 Firmware: before 1.14 (fixed in 1.14)
• ZTE Blade v20 Smart Firmware: before 1.14 (fixed in 1.14)
• ZTE Blade v30 Firmware: before 1.11 (fixed in 1.11)
• ZTE Blade v30 Vita Firmware: before 1.11 (fixed in 1.11)
• ZTE Blade v40 Vita Firmware: before 11.0.2_8045 (fixed in 11.0.2_8045)
• ZTE v40 Pro Firmware: before 11.0.4_9046 (fixed in 11.0.4_9046)

Published 2023-05-30. Last modified 2026-06-17.