CVE-2023-41780 is a medium severity (CVSS 6.4) unsafe DLL loading flaw in ZTE ZXCLOUD iRAI. Poor input validation lets an attacker escalate local privileges. ZTE lists versions up to 7.23.23 as affected for this CVE and 7.23.32 as the resolved version.
What's affected
ZTE's advisory (published January 3, 2024) lists ZXCLOUD iRAI as the affected product and says all versions up to 7.23.23 are affected for this CVE. The resolved version in its table is 7.23.32, and ZTE says devices that support automatic update will show an update prompt; otherwise contact your service provider.
The ZTE advisory covers four CVEs in ZXCLOUD iRAI: CVE-2023-41779 (illegal memory access, 4.4), CVE-2023-41780 (unsafe DLL loading, 6.4), CVE-2023-41776 (local privilege escalation, 6.7) and CVE-2023-41783 (command injection, 4.3).
ZTE and the NVD record agree on the scores.
The record scores the flaw 6.4 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. It can be reached with local access to the machine, the attack complexity is high, it requires high privileges (an administrator account), and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness classes are CWE-22 (path traversal) and CWE-427 (uncontrolled search path element). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
ZXCLOUD iRAI is ZTE desktop cloud software, so check the version through the product itself or ask your service provider, who supplies updates. Compare it with the affected range above and with the resolved version, 7.23.32.
Then look at who has local accounts on machines that run it. The vector shows a local attack path, so shared machines are the ones to worry about.
What to do now
- Find ZXCLOUD iRAI installs and read their versions.
- Update to 7.23.32 or later through the automatic update prompt, or ask your service provider for the update.
- Restrict local sign in on machines that run it to people who need access.
- Read the ZTE advisory for the other three CVEs and cover them in the same update.
Why it matters
The weaknesses are CWE-22, path traversal, and CWE-427, uncontrolled search path element. The program fails to validate a path properly and so can be steered into loading a library from a place it should not trust. Code in that library then runs with the program's rights.
The vector shows high privileges and high attack complexity, which holds the score to medium. DLL loading bugs are a classic way to turn local write access into elevated code execution, so they belong in a routine patch cycle.
Quick check
Does the attacker need admin rights?
The vector shows high privileges required, high complexity and a local attack path.
Which version is affected?
ZTE says all versions up to 7.23.23 for this CVE. The resolved version in its table is 7.23.32.
Sources
Last reviewed: 19 October 2026.
