CVE-2025-26705
Published: 11 March 2025
Summary
CVE-2025-26705 is a medium-severity Improper Privilege Management (CWE-269) vulnerability in Zte Goldendb. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 44.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-26705 is an Improper Privilege Management vulnerability (CWE-269) in ZTE GoldenDB that allows privilege escalation. The issue affects GoldenDB versions from 6.1.03 through 6.1.03.05, as published on 2025-03-11.
The vulnerability has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating it is exploitable over the network with low attack complexity, requiring no privileges, no user interaction, and unchanged scope. Unauthenticated remote attackers can leverage this flaw to escalate privileges, resulting in low-impact disclosure of confidential information without affecting integrity or availability.
Mitigation guidance is available in the ZTE security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/577084989971263576.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7711
Vulnerability details
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an improper privilege management vulnerability that directly enables unauthenticated remote attackers to escalate privileges in the GoldenDB application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the improper privilege management vulnerability by enforcing least privilege to prevent unauthorized escalation in ZTE GoldenDB.
Ensures proper creation, modification, and review of accounts to avoid excessive privileges that enable the escalation flaw in affected GoldenDB versions.
Remediates the specific software flaw causing privilege escalation by identifying, testing, and applying vendor patches for CVE-2025-26705.