PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44408 ZTE CVE debrief

A medium-severity unauthorized access vulnerability exists in the ZTE MU5250, a mobile broadband device. The vulnerability stems from improper permission controls on the Web management interface, allowing an attacker with local network access and low privileges to modify device configuration without proper authorization. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) indicates attack complexity is low, no user interaction is required, and while confidentiality impact is none, integrity impact is low and availability impact is high—suggesting configuration changes could lead to service disruption. The vulnerability was disclosed by ZTE's PSIRT and is currently in 'Deferred' status in the NVD, indicating the entry may be awaiting additional analysis or vendor coordination. No known exploitation in ransomware campaigns has been reported.

Vendor
ZTE
Product
MU5250
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-19
Advisory published
2026-05-19
Advisory updated
2026-05-19

Who should care

Organizations deploying ZTE MU5250 mobile broadband devices for remote connectivity, telecommunications providers managing CPE fleets, and security teams responsible for IoT/telecom device hardening should prioritize this vulnerability for assessment and remediation.

Technical summary

The ZTE MU5250 Web interface fails to enforce proper authorization checks, permitting authenticated attackers with low privileges to modify device configuration settings. The attack requires adjacent network access (AV:A) with low attack complexity. While the vulnerability does not expose confidential data, successful exploitation can alter device integrity and significantly impact availability. The underlying weakness is categorized as CWE-200 (Information Exposure), though the primary security concern is improper authorization rather than information disclosure.

Defensive priority

medium

Recommended defensive actions

  • Review ZTE security bulletin for affected firmware versions and patch availability
  • Restrict Web interface access to trusted administrative hosts only
  • Implement network segmentation to limit attacker access to device management interfaces
  • Monitor for unauthorized configuration changes in ZTE MU5250 deployments
  • Apply firmware updates from ZTE when available per vendor security advisory

Evidence notes

Vulnerability description and CVSS vector sourced from NVD record with ZTE PSIRT as primary reference source. Vendor identification marked as requiring review due to 'Unknown Vendor' classification in source data despite clear ZTE product reference. CPE criteria not yet populated in NVD entry.

Official resources

2026-05-19