Read the docs
TI-2025-29292 Aliases CVE-2025-46579GHSA-8x47-7hq5-rq2m

ZTE GoldenDB Database product has a DDE injection vulnerability

Priority LOW 38CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download and open the affected file, the DDE commands can be executed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00323 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZTEGoldenDB6.1.03 – 6.1.03.10; 7.2.01.01; Lite7.2.01.01—No fix listedCNA
  • GoldenDB VendorZTE Affected 6.1.03 – 6.1.03.10; 7.2.01.01; Lite7.2.01.01 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:zte:zxcloud_goldendb:*:*:*:*:*:*:*:*6.1.03 to before 6.1.03.11VulnerableZTE
cpe:2.3:a:zte:zxcloud_goldendb:7.2.01.01:-:*:*:-:*:*:*7.2.01.01VulnerableZTE
cpe:2.3:a:zte:zxcloud_goldendb:7.2.01.01:-:*:*:lite:*:*:*7.2.01.01VulnerableZTE
  • cpe:2.3:a:zte:zxcloud_goldendb:*:*:*:*:*:*:*:* Versions 6.1.03 to before 6.1.03.11 Vulnerable ·ZTE
  • cpe:2.3:a:zte:zxcloud_goldendb:7.2.01.01:-:*:*:-:*:*:* Versions 7.2.01.01 Vulnerable ·ZTE
  • cpe:2.3:a:zte:zxcloud_goldendb:7.2.01.01:-:*:*:lite:*:*:* Versions 7.2.01.01 Vulnerable ·ZTE

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-46579
  2. 2026-10-03 Alias added: GHSA-8x47-7hq5-rq2m

References

Advisory 1

  • TI-2025-29293 ZTE GoldenDB Database product has a code-related vulnerability CVSS 3.1HIGH 7.7
  • TI-2025-29291 ZTE GoldenDB Database product has SQL injection vulnerabilities in multiple interfaces CVSS 3.1HIGH 7.5
  • TI-2025-29290 ZTE GoldenDB Database product has an SQL injection vulnerability CVSS 3.1HIGH 7.5
  • TI-2025-29288 ZTE GoldenDB Database product has an information disclosure vulnerability CVSS 3.1HIGH 7.5
  • TI-2025-29289 ZTE GoldenDB Database product has a privilege escalation vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2025-29287 ZTE GoldenDB Database product has an input validation vulnerability CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences