Low Severity
Published: Oct 25, 2026
PoC: authenticated admin web session to root on the ZTE G5TS (firmware BD_MEDGEG5TSV1.0.0B07). Write-up plus self-contained exploit/verify/revert tooling.
# ZTE G5TS — authenticated admin → root (firmware `BD_MEDGEG5TSV1.0.0B07`)
Post-auth privilege escalation to **`uid=0(root)`** on the ZTE G5TS 5G CPE.
No reboot, no flashing, no kernel exploit.
**Keywords:** ZTE G5TS, `BD_MEDGEG5TSV1.0.0B07`, cgi-io, cgi-exec, cgi-upload,
ubus, zwrt_router, OpenWrt, firewall3, fw3, miniupnpd/firewall.include, /etc_rw,
overlayfs, UBIFS, router root, authenticated privilege escalation, RCE.
## Vulnerability
An authenticated admin web session reaches root through three flaws:
1. **`cgi-io` gives the CGI user (`nobody`) write + exec.** `POST /cgi-bin%2fcgi-upload`
writes `/tmp/back_parameter`; `cgi-exec` `execv()`s an arbitrary program as
`nobody` (uid 65534).
2. **`nobody` can unlink/recreate files** under `/etc`, `/etc/config`,
`/etc/init.d`, `/etc/hotplug.d`, `/usr/share`, `/etc_rw`, `/var`, `/cache`
(overlayfs/UBIFS with over-permissive modes/ACLs).
3. **fw3 (root) executes a script from a writable path.** `/etc/config/firewall`
includes `/usr/share/miniupnpd/firewall.include` with `type 'script'` +
`reload '1'`; fw3 runs it as root on firewall reload.
Replace that include with `original rules + payload`, then fire a benign RPC that
reloads the firewall (`zwrt_router.api router_set_remote_acl`) → payload runs as
root.
```
admin web session ──ubus_rpc_session──▶ cgi-io (cgi-upload + cgi-exec)
│
▼ shell as nobody (uid 65534)
unlink + recreate /usr/share/miniupnpd/firewall.include
│
▼ firewall reload (benign RPC)
fw3 runs the include as root ──▶ uid=0(root)
```
## Affected
| Field | Value |
|---|---|
| Vendor / product | ZTE G5TS (5G CPE) |
| Firmware tested | `BD_MEDGEG5TSV1.0.0B07` (aarch64, Linux 5.4.154, OpenWrt-based) |
| Privilege required | authenticated **admin** web session |
| Impact | code execution as `root` |
| CVE | not assigned |
| Reboot / flash | not required |
Derivatives shipping the same `cgi-io`, the same over-permissive overlay/UBIFS
layout, and t