CVE-2025-46581

CriticalRCE

Published: 14 October 2025

Published

14 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0034 57.3th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-46581 is a critical-severity Code Injection (CWE-94) vulnerability in Com (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-46581 is a remote code execution (RCE) vulnerability affecting ZTE's ZXCDN product, caused by a flaw in Apache Struts. Published on 2025-10-14, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-94 (Code Injection). The issue allows arbitrary command execution on impacted ZXCDN instances.

An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Successful exploitation enables the execution of commands with non-root privileges, potentially leading to high confidentiality, integrity, and availability impacts.

ZTE has issued a security bulletin providing details on the vulnerability at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3747693852734546826, which security practitioners should consult for mitigation and patching guidance.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-34151

Vulnerability details

ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges.

CWE(s): CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2025-46581 is a critical unauthenticated RCE vulnerability in Apache Struts within ZTE's public-facing ZXCDN product, directly enabling exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0