CVE-2025-26705

Medium

Published: 11 March 2025

Published

11 March 2025

Modified

19 March 2025

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score 0.0032 55.5th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26705 is a medium-severity Improper Privilege Management (CWE-269) vulnerability in Zte Goldendb. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 44.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-6 Least Privilege good match

prevent

Directly counters the improper privilege management vulnerability by enforcing least privilege to prevent unauthorized escalation in ZTE GoldenDB.

AC-2 Account Management good match

prevent

Ensures proper creation, modification, and review of accounts to avoid excessive privileges that enable the escalation flaw in affected GoldenDB versions.

SI-2 Flaw Remediation good match

prevent

Remediates the specific software flaw causing privilege escalation by identifying, testing, and applying vendor patches for CVE-2025-26705.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The CVE describes an improper privilege management vulnerability that directly enables unauthenticated remote attackers to escalate privileges in the GoldenDB application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.

Deeper analysisAI

CVE-2025-26705 is an Improper Privilege Management vulnerability (CWE-269) in ZTE GoldenDB that allows privilege escalation. The issue affects GoldenDB versions from 6.1.03 through 6.1.03.05, as published on 2025-03-11.

The vulnerability has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating it is exploitable over the network with low attack complexity, requiring no privileges, no user interaction, and unchanged scope. Unauthenticated remote attackers can leverage this flaw to escalate privileges, resulting in low-impact disclosure of confidential information without affecting integrity or availability.

Mitigation guidance is available in the ZTE security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/577084989971263576.