The vulnerability exists in the BootROM of the ZTE ZX297520V3 and allows an attacker to perform arbitrary memory writes when the device is in USB download mode. By exploiting the lack of target address validation, the attacker can overwrite arbitrary locations in runtime memory, including the stack. This manipulation can hijack the execution flow, bypass the Secure Boot signature verification, and ultimately grant the attacker the ability to run malicious code on the device. The weakness corresponds to an unchecked write leading to potential compromise of confidentiality, integrity, or availability of the system. The described impact is the ability to execute unauthorized code with the privilege level of the BootROM.

The affected system is the ZTE ZX297520V3 BootROM. No additional versions or vendors are listed beyond the single product identifier ZTE:ZX297520V3 BootROM.

The CVSS score of 5.1 indicates moderate severity, and the exploit probability (EPSS) is currently not available. This vulnerability is not included in the CISA KEV catalog. The attacker would need physical access or the ability to connect a USB device to the target device, or the device would need to be in a state that allows USB download mode. The lack of address validation directly enables arbitrary memory modification, making exploitation straightforward once the attack vector is achieved. Due to the moderate CVSS score, organizations should assess the criticality of the device in their environment before determining the urgency of mitigation.