CVE-2026-49002

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49002", "assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb", "state": "PUBLISHED", "assignerShortName": "zte", "dateReserved": "2026-05-27T01:01:53.326Z", "datePublished": "2026-05-27T08:19:15.774Z", "dateUpdated": "2026-05-28T03:45:30.241Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6786b568-6808-4982-b61f-398b0d9679eb", "shortName": "zte", "dateUpdated": "2026-05-28T03:45:30.241Z"}, "title": "Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "ZTE", "product": "ZXUniPOS NDS-LTE", "versions": [{"status": "affected", "version": "Versions < V24.40.40CP01 (excluding V24.30.40CP03, V24.40.40CP01)"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.</p>"}]}], "references": [{"url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/6783201397271515377"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "credits": [{"lang": "en", "value": "Venom Nguyen from VNPT-NET", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T13:40:30.105103Z", "id": "CVE-2026-49002", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:40:37.935Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49002", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-27T13:40:30.105103Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:40:33.877Z"}}], "cna": {"title": "Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Venom Nguyen from VNPT-NET"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ZTE", "product": "ZXUniPOS NDS-LTE", "versions": [{"status": "affected", "version": "Versions < V24.40.40CP01 (excluding V24.30.40CP03, V24.40.40CP01)"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/6783201397271515377"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.", "supportingMedia": [{"type": "text/html", "value": "<p>Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "6786b568-6808-4982-b61f-398b0d9679eb", "shortName": "zte", "dateUpdated": "2026-05-28T03:45:30.241Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49002", "state": "PUBLISHED", "dateUpdated": "2026-05-28T03:45:30.241Z", "dateReserved": "2026-05-27T01:01:53.326Z", "assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb", "datePublished": "2026-05-27T08:19:15.774Z", "assignerShortName": "zte"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ZXUniPOS NDS-LTE", "vendor": "ZTE", "versions": [{"status": "affected", "version": "Versions < V24.40.40CP01 (excluding V24.30.40CP03, V24.40.40CP01)"}]}], "source": "psirt@zte.com.cn"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information."}, {"lang": "es", "value": "Fallo en el control de acceso significa que una aplicaci\u00f3n no verifica eficazmente los permisos de acceso de los usuarios, de modo que usuarios no autorizados pueden acceder a datos del sistema m\u00e1s all\u00e1 de sus permisos, como ver y modificar informaci\u00f3n de configuraci\u00f3n."}], "id": "CVE-2026-49002", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "psirt@zte.com.cn", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49002", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T13:40:30.105103Z", "version": "2.0.3"}}]}, "published": "2026-05-27T09:16:32.253", "references": [{"source": "psirt@zte.com.cn", "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/6783201397271515377"}], "sourceIdentifier": "psirt@zte.com.cn", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@zte.com.cn", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V24.30.40CP02]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V24.40.40]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ZXUniPOS NDS-LTE", "source": "cna", "vendor": "ZTE"}, "product": "zxunipos_nds-lte", "vendor": "zte"}], "created": "2026-05-27T11:15:20.210591+00:00", "updated": "2026-05-27T11:45:15.155777+00:00", "vendors": ["zte", "zte$PRODUCT$zxunipos_nds-lte"]}