How severe is CVE-2018-7365?

CVE-2018-7365 has a CVSS 3.x base score of 5.1, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2018-7365 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-7365?

CVE-2018-7365 primarily affects Zte Zxcloud Irai. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-7365?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-7365 published?

CVE-2018-7365 was published on 2018-12-20 and last updated on 2026-06-17.

CVE-2018-7365

CVE-2018-7365 is a medium-severity vulnerability in Zte Zxcloud Irai with a CVSS 3.x base score of 5.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-426.

Key facts

Severity: Medium (CVSS 3.x base score 5.1)
CVSS v2: 6.5
EPSS exploit prediction: 1% (48th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-426
Affected product: Zte Zxcloud Irai
Published: 2018-12-20
Last modified: 2026-06-17

Description

All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized user to perform unauthorized operations.

Frequently asked questions

What is CVE-2018-7365?: All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized user to perform unauthorized operations.
How severe is CVE-2018-7365?: CVE-2018-7365 has a CVSS 3.x base score of 5.1, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2018-7365 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-7365?: CVE-2018-7365 primarily affects Zte Zxcloud Irai. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-7365?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-7365 published?: CVE-2018-7365 was published on 2018-12-20 and last updated on 2026-06-17.

References

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010005

Affected products (2)

cpe:2.3:a:zte:zxcloud_irai:*:*:*:*:*:*:*:*
cpe:2.3:a:zte:usmartview:-:*:*:*:*:*:*:*

More vulnerabilities in Zte Zxcloud Irai

CVE-2021-21731 — High (CVSS 8.1): A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management…
CVE-2023-41776 — Medium (CVSS 6.7): There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can…
CVE-2023-25650 — Medium (CVSS 6.5): There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or…
CVE-2023-25648 — Medium (CVSS 6.5): There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an…
CVE-2023-41780 — Medium (CVSS 6.4): There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate…
CVE-2024-22062 — Medium (CVSS 6.3): There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator…

All CVEs affecting Zte Zxcloud Irai →

Other CWE-426 (Untrusted Search Path) vulnerabilities

CVE-2026-45772 — Critical (CVSS 9.8): Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14,…
CVE-2025-26155 — Critical (CVSS 9.8): NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path…
CVE-2024-53866 — Critical (CVSS 9.8): The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one…
CVE-2024-38462 — Critical (CVSS 9.8): iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the…
CVE-2023-30330 — Critical (CVSS 9.8): SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function…
CVE-2022-24826 — Critical (CVSS 9.8): On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and…

Browse all CWE-426 (Untrusted Search Path) vulnerabilities →