CVE-2023-41776 is a medium severity (CVSS 6.7) local privilege escalation flaw in ZTE ZXCLOUD iRAI. A user with regular privileges can create a fake process and escalate privileges. ZTE lists versions up to 7.23.31 as affected and 7.23.32 as the resolved version.
What's affected
ZTE's advisory (published January 3, 2024) lists ZXCLOUD iRAI as the affected product and says all versions up to 7.23.31 are affected for this CVE. The resolved version in its table is 7.23.32, and ZTE says devices that support automatic update will show an update prompt; otherwise contact your service provider.
The ZTE advisory covers four CVEs in ZXCLOUD iRAI: CVE-2023-41779 (illegal memory access, 4.4), CVE-2023-41780 (unsafe DLL loading, 6.4), CVE-2023-41776 (local privilege escalation, 6.7) and CVE-2023-41783 (command injection, 4.3).
ZTE and the NVD record agree on the scores.
The record scores the flaw 6.7 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. It can be reached with local access to the machine, the attack complexity is high, it requires low privileges, and it needs a user to take part (for example by opening or visiting something). The impact on confidentiality is high, on integrity high and on availability high. The weakness classes are CWE-732 (incorrect permission assignment for a critical resource) and CWE-269 (improper privilege management). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
ZXCLOUD iRAI is ZTE desktop cloud software, so check the version through the product itself or ask your service provider, who supplies updates. Compare it with the affected range above and with the resolved version, 7.23.32.
Then look at who has local accounts on machines that run it. The vector shows a local attack path, so shared machines are the ones to worry about.
What to do now
- Find ZXCLOUD iRAI installs and read their versions.
- Update to 7.23.32 or later through the automatic update prompt, or ask your service provider for the update.
- Restrict local sign in on machines that run it to people who need access.
- Read the ZTE advisory for the other three CVEs and cover them in the same update.
Why it matters
The weaknesses are CWE-732, incorrect permission assignment for a critical resource, and CWE-269, improper privilege management. A trusted component accepts something a normal user can influence, here a process the user controls, and acts on it with higher rights.
The vector rates complexity high and needs a user action, so this is a foothold-to-control step, not an entry point. Desktop virtualization hosts often serve many users, which raises the value of any local escalation.
Quick check
Is CVE-2023-41776 remote?
No. The vector shows local access, high complexity and a required user action.
What fixes it?
ZTE lists 7.23.32 as the resolved version for ZXCLOUD iRAI.
Sources
Last reviewed: 19 October 2026.
