PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44408 ZTE CVE debrief

A medium-severity unauthorized access vulnerability exists in the ZTE MU5250, a mobile broadband device. The vulnerability stems from improper permission controls on the Web management interface, allowing an attacker with local network access and low privileges to modify device configuration without proper authorization. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) indicates attack complexity is low, no user interaction is required, and while confidentiality impact is none, integrity impact is low and availability impact is high—suggesting configuration changes could lead to service disruption. The vulnerability was disclosed by ZTE's PSIRT and is currently in 'Deferred' status in the NVD, indicating the entry may be awaiting additional analysis or vendor coordination. No known exploitation in ransomware campaigns has been reported.

Vendor
ZTE
Product
MU5250
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

Organizations deploying ZTE MU5250 mobile broadband devices for remote connectivity, telecommunications providers managing CPE fleets, and security teams responsible for IoT/telecom device hardening should prioritize this vulnerability for assessment and remediation.

Technical summary

The ZTE MU5250 Web interface fails to enforce proper authorization checks, permitting authenticated attackers with low privileges to modify device configuration settings. The attack requires adjacent network access (AV:A) with low attack complexity. While the vulnerability does not expose confidential data, successful exploitation can alter device integrity and significantly impact availability. The underlying weakness is categorized as CWE-200 (Information Exposure), though the primary security concern is improper authorization rather than information disclosure.

Defensive priority

medium

Recommended defensive actions

  • Review ZTE security bulletin for affected firmware versions and patch availability
  • Restrict Web interface access to trusted administrative hosts only
  • Implement network segmentation to limit attacker access to device management interfaces
  • Monitor for unauthorized configuration changes in ZTE MU5250 deployments
  • Apply firmware updates from ZTE when available per vendor security advisory

Evidence notes

Vulnerability description and CVSS vector sourced from NVD record with ZTE PSIRT as primary reference source. Vendor identification marked as requiring review due to 'Unknown Vendor' classification in source data despite clear ZTE product reference. CPE criteria not yet populated in NVD entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44408 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44408

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44408 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44408

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.