A flaw in the openssl.cnf configuration file used by the ZTE Cloud PC client uSmartview permits an attacker to run arbitrary code on the host with elevated privileges. The vulnerability is a classic example of the "unspecified binary location" weakness documented as CWE-427, where improper handling of dynamic library search paths can lead to exploitation. When triggered, the attacker can gain full control of the client’s operating system on the affected machine. The description confirms that the impact is local, requiring the attacker to already have some foothold on the target system.

The affected products are ZTE’s Cloud PC Client "uSmartview" as part of the ZXCLOUD iRAI suite. No specific version information is provided in the data, so any installation that relies on the openssl.cnf configuration file and has not applied a vendor patch remains at risk.

The CVSS score of 5.5 indicates moderate severity, with the primary risk being privilege escalation rather than remote exploitation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting there is no known widespread exploitation activity yet. The attack vector is inferred to be local; an adversary must already be on the machine or have the ability to write to configuration files in order to trigger the exploit. Because the flaw arises from an improper configuration, it can be mitigated by disabling or tampering with the openssl.cnf file or by ensuring the application runs with the least privilege necessary.