CVE-2023-41783 is a medium severity (CVSS 4.3) command injection flaw in ZTE ZXCLOUD iRAI. Poor input validation lets an attacker escalate local privileges, and the vector calls for physical access. ZTE lists versions up to 7.22.11P2 as affected and 7.23.32 as the resolved version.
What's affected
ZTE's advisory (published January 3, 2024) lists ZXCLOUD iRAI as the affected product and says all versions up to 7.22.11P2 are affected for this CVE. The resolved version in its table is 7.23.32, and ZTE says devices that support automatic update will show an update prompt; otherwise contact your service provider.
The ZTE advisory covers four CVEs in ZXCLOUD iRAI: CVE-2023-41779 (illegal memory access, 4.4), CVE-2023-41780 (unsafe DLL loading, 6.4), CVE-2023-41776 (local privilege escalation, 6.7) and CVE-2023-41783 (command injection, 4.3).
ZTE and the NVD record agree on the scores.
The record scores the flaw 4.3 (Medium) with the vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. It can be reached with physical access to the device, the attack complexity is low, it requires no privileges, and it needs no user interaction. The impact on confidentiality is low, on integrity low and on availability low. The weakness class is CWE-94 (code injection). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
ZXCLOUD iRAI is ZTE desktop cloud software, so check the version through the product itself or ask your service provider, who supplies updates. Compare it with the affected range above and with the resolved version, 7.23.32.
Then look at who has local accounts on machines that run it. The vector shows a local attack path, so shared machines are the ones to worry about. The vector here is physical, so also consider who can touch the devices.
What to do now
- Find ZXCLOUD iRAI installs and read their versions.
- Update to 7.23.32 or later through the automatic update prompt, or ask your service provider for the update.
- Restrict local sign in on machines that run it to people who need access.
- Read the ZTE advisory for the other three CVEs and cover them in the same update.
Why it matters
The weakness is CWE-94, code injection. Input that should be treated as data is built into something the system runs, so a person with access can make it run their commands. The vector needs physical access, no privileges and no user interaction, with low impact on all three areas.
The physical requirement makes this the least urgent of the four ZTE CVEs, but thin client and desktop cloud devices sit in places that are not always locked down. Updating also removes the issue for the rest of the fleet.
Quick check
Why is the score only 4.3?
The attack path is physical and the impact is low on confidentiality, integrity and availability.
What fixes it?
ZTE lists 7.23.32 as the resolved version in its table.
Sources
Last reviewed: 19 October 2026.
