CVE-2026-40003
MEDIUMZTE ZX297520V3 BootROM - USB Arbitrary Memory Write
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2026-40003. PoCs published by rva3, XZ1r0.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-40003, an arbitrary memory write vulnerability in the ZXIC/Sanechips ZX297520V3 SoC BootROM. The exploit leverages the USB download mode to achieve arbitrary memory writes and execute payloads by manipulating the stack and return address.
Description
ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.
Exploits (2)
This repository contains a functional exploit for CVE-2026-40003, an arbitrary memory write vulnerability in the ZXIC/Sanechips ZX297520V3 SoC BootROM. The exploit leverages the USB download mode to achieve arbitrary memory writes and execute payloads by manipulating the stack and return address.
This repository contains a functional exploit for CVE-2026-40003, targeting a ZXIC/Sanechips BootROM vulnerability. The exploit leverages USB communication to achieve arbitrary memory write, allowing execution of unsigned code on the ZX297520V3 SoC.
References (1)
Scores
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L