root access to ZTE: 5 working methods + how to avoid the “brick”

Getting root access on smartphones ZTE is a task that attracts experienced users with the possibility of complete control over the system: from removing built-in software to fine-tuning performance. However, the process is fraught with risks - from loss of warranty to turning the device into a “brick”. In this article we will look at current methods for models 2018–2026 yearsincluding Blade, Axon and Nubia, as well as legal alternatives that provide some of the functions of root without hacking.

It is important to understand: ZTE actively blocks vulnerabilities used to gain superuser rights. If your device was updated over the air (OTA) after 2023, the chances of success are reduced. We will not consider outdated exploits like DirtyCOW or KingRoot —they either do not work on new firmware or contain malicious code. Instead, let's focus on proven tools and official loopholes.

1. Why you may not need root on ZTE

Before you risk your device, evaluate whether you really need root access. Modern versions of Android (starting from 10) provide many functions without jailbreaking:

• 🔧 Uninstalling system applications: via adb shell pm uninstall -k --user 0 package_name (without root, but requires USB debugging).
• 📱 Moving applications to an SD card: in application settings → “Storage” → “Edit”.
• 🔋 Battery optimization: power saving modes in Settings → Battery.
• 🛡️ Ad blocking: via DNS servers (for example, 1.1.1.3 in Wi-Fi settings).

On ZTE devices with firmware MiFavor (for example, Blade V40 or Axon 40 Ultra) “Developer Mode” is available with advanced settings that replace 70% of root functions. It is activated via Settings → About phone → Build number (tap 7 times).

⚠️ Attention: If your goal is to play modified games (for example, with cheats), please note that ZTE actively blocks devices with an unlocked bootloader in services Google Play Protect. This may lead to account ban.

2. Preparing the device: 7 mandatory steps

Before trying to get root, follow these steps to minimize risks:

Unlock OEM in the developer settings

Enable USB debugging

Make a full backup of your data (including IMEI)

Charge the phone to at least 70%

Install ZTE drivers on PC (from the official website)

Download the correct firmware version (stock ROM) for your model

Prepare a USB cable that supports data transfer (not just charging)

-->

Pay special attention backup IMEI. On some models ZTE (for example, Nubia Z40 Pro) after an unsuccessful root, the IMEI may be erased, which will make the phone unsuitable for calls. For backup, use the application MTK Engineering Mode (for MediaTek chips) or QPST (for Qualcomm).

Also check the bootloader status with the command:

adb reboot bootloader
fastboot oem device-info

If the response contains line Device unlocked: false, the bootloader is locked - it needs to be unlocked (more on this in the next section).

3. Unlocking the bootloader on ZTE

It is impossible to get root without an unlocked bootloader. ZTE, unlike Xiaomi or Samsung, does not provide an official unlocking tool, but there are workarounds.

Method 1: Via Fastboot (for most models)

1. Connect the phone to the PC in mode fastboot (turn off the device, hold Volume up + Power).
2. Run the command:

   fastboot flashing unlock

   On some devices (for example Blade A7), you may need to first obtain an unlock code through the service ZTE (see method 2).

3. Confirm unlocking on your phone (with the volume button).

Method 2: Official code request (for new models)

For devices 2022 and newer (Axon 50 Ultra, Nubia Z50) you need:

1. Get IMEI phone (dial *#06#).
2. Send an unlock request through the form on website ZTE (support section). You will have to indicate the reason (select “For development”).
3. Wait 3-7 days for a response. The code will be sent to the email associated with your account. ZTE.
4. Enter the code in fastboot:

   fastboot flashing unlock [your_code]

⚠️ Attention: Unlocking the bootloader resets the device to factory settings and will void the warranty. On some models (Blade V30) after unlocking it stops working Widevine L1 —video on Netflix and Disney+ will be shown in low resolution.

Fastboot (flashing unlock)

Official code from ZTE

Bypass via exploit (for example, CVE-2023-21085)

Haven't tried it yet-->

4. Methods for obtaining root access for ZTE

After unlocking the bootloader, you can begin to obtain root. The choice of method depends on the processor of your device:

Method	Suitable models	Difficulty	Risks
Magisk (patched boot)	All models with an unlocked bootloader	Average	Minimum (reversible process)
Custom Recovery (TWRP)	Blade, Axon (until 2022)	High	Soft-brick possible
Exploit CVE-2023-21085	Nubia Z40S Pro, Blade V40 Vita	Low	Closed in updates after May 2023
OneClick tools	Outdated models (until 2020)	Low	High risk of malware

Method 1: Magisk (recommended)

The most reliable method, working on 90% of devices ZTE:

1. Download the latest version Magisk (file Magisk-v26.4.zip).
2. Download stock boot.img for your model (search on 4PDA or XDA Developers).
3. Submit boot.img on your phone and through Magisk Manager, select “Install” → “Select and Patch a File.”
4. After patching, copy the resulting file magisk_patched.img on a PC.
5. Flash it via fastboot:

   fastboot flash boot magisk_patched.img
   fastboot reboot

After reboot, check root with the command:

adb shell su

If you see the prompt # - root received.

Method 2: Custom Recovery (TWRP)

For older models (Blade A5, Axon 10 Pro):

1. Download TWRP for your model (file .img).
2. Flash recovery:

   fastboot flash recovery twrp-3.7.0_9-0-blade.img

3. Boot into TWRP (Volume up + Power), then flash Magisk.zip via “Install”.

⚠️ Attention: On some devices ZTE s Dynamic Partition (for example Blade V40) custom recovery firmware may lead to data loss in sections vendor i product. Before the procedure, make a full backup via adb backup.

5. Risks and how to minimize them

Even if you successfully obtain root, problems are possible:

• 🚫 Blocking banking applications: SberBank Online, Tinkoff and others refuse to work on rooted ones. devices. The solution is to use MagiskHide or module SafetyNet Fix.
• 📵 Network loss: On some ZTE after rooting, mobile communication is lost. Check if the IMEI has been erased and restore it via Maui META (for MediaTek) or QCN (for Qualcomm).
• 🔄 Looping on loading: If after flashing Magisk the phone does not boot, try:
  • Flash original boot.img back.
  • Reset via fastboot -w.
  • Install Disable_Dm-Verity_ForceEncrypt (for devices with encryption).

How to check if SafetyNet is blocked:

1. Install the application SafetyNet Test from Play Market.
2. If the test fails, in Magisk enable:

   Settings → MagiskHide (enable)
   Settings → Zygisk (enable)
   Modules → SafetyNet Fix (install)

What to do if SafetyNet does not work even with MagiskHide?

1. Remove all Magisk modules except SafetyNet Fix.

2. In Magisk settings, disable "Enforce DenyList" and add Google Play Services and banking applications to DenyList.

3. Reboot the device and check again.

4. If it doesn’t help, flash Magisk to the recovery partition instead of boot (for some devices this bypasses the checks).

6. Alternatives to root: what you can do without hacking

If the risks scare you away, consider legal ways to expand the capabilities ZTE:

• 🔓 ADB commands without root:

  adb shell pm grant application package android.permission.WRITE_SECURE_SETTINGS

  Allows you to change system settings (for example, animation speed).

• 📦 Island (Sandbox): Creates an isolated environment for cloning applications without root.
• 🔋 AccA (Accumulate Battery): Optimizes the battery via ADB (does not require root).
• 🛠️ Shizuku: Provides part of the root application API via ADB.

For models with MiFavor UI (for example, Blade V30) is available "Mode for developers" with options:

• Disable forced dark mode for individual applications.
• Setting background activity restrictions.
• Enable the display of overlays (for applications like Chat Heads).

7. How to get everything back: roll back root and lock the bootloader

If you decide to sell your phone or return it to the service, you need to:

1. Remove Magisk through its manager (“Full Uninstall”).
2. Flash the original boot.img:

   fastboot flash boot stock_boot.img

3. Block bootloader:

   fastboot flashing lock

   ⚠️ This will reset all data again!

4. Flash the stock-ROM via fastboot update rom.zip (if a full reset is required).

Check bootloader status:

fastboot oem device-info

Must be Device unlocked: false.

⚠️ Attention: On some models ZTE (for example Nubia Red Magic), locking the bootloader may lead to the loss of DRM keys. This means that Netflix and other streaming services will only work in SD quality.

FAQ: Frequently asked questions about rooting on ZTE

Is it possible to get root on ZTE without unlocking the bootloader?

Theoretically, yes, but only through exploits that are closed in new ones firmware. For example, the vulnerability CVE-2023-21085 worked on some ZTE Android 12, but after updating to Android 13 it was fixed. Nowadays it is almost impossible to get root without an unlocked bootloader.

Why does the mobile data not work after rooting?

Most likely, the IMEI has been erased or the modem settings have been damaged. To restore:

1. For MediaTek: use MTK Engineering Mode → Connectivity → CDS Information → Radio Information → Phone 1 → enter the AT command to restore IMEI.
2. For Qualcomm: flash the original modemst1.stm i modemst2.stm via QFil.

If it doesn’t help, contact the service center with the saved IMEI backup.

How to bypass blocking of banking applications on rooted ZTE?

Methods in order of effectiveness:

1. Install the module MagiskHide Props Config and change the device fingerprint to a certified one (for example, Pixel 6).
2. Use Island or Shelter to isolate banking applications in a separate profile.
3. Disable Magisk for specific applications via DenyList.
4. Install LSPosed with module Hide My Applist to mask root.

If nothing does not help - temporarily uninstall Magisk (via the manager) while using banking applications.

Is it possible to update OTA firmware with root?

No, over-the-air (OTA) updates on rooted devices ZTE lead to loss of root or system loop. update:

1. Download the full firmware package (update.zip) from the official website ZTE.
2. Uninstall Magisk through its manager.
3. Flash the firmware via fastboot update update.zip.
4. After updating, repeat the receiving process root.

Which ZTE models are easiest to root?

The most root-friendly:

• ZTE Blade A7 (2020) - unlocking the bootloader via fastboot, Magisk works without problems.
• ZTE Axon 10 Pro - there is a custom recovery (TWRP), but requires disabling dm-verity.
• Nubia Z20 —supports projects LineageOS, which simplifies rooting.

The most difficult thing:

• ZTE Blade V40 (2022+)—dynamic partitions, problems with SafetyNet.
• Nubia Red Magic 8 Pro —locked bootloader, official code is required.