PatchSiren cyber security CVE debrief

CVE-2026-44410 ZTE CVE debrief

A business logic vulnerability in ZTE products allows authenticated administrators to exploit legitimate application functions in unintended ways. The flaw stems from improper implementation of business logic controls (CWE-1240), enabling malicious use of authorized capabilities outside their designed scope. The vulnerability requires high privileges (PR:H) with network access, and has low impact on integrity and availability. ZTE has published a security bulletin addressing this issue.

Vendor: ZTE
Product: ZXUniPOS NDS-LTE
CVSS: LOW 3.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-26
Original CVE updated: 2026-05-26
Advisory published: 2026-05-26
Advisory updated: 2026-05-26

Who should care

ZTE product administrators, security teams managing ZTE infrastructure, and organizations with administrative access controls requiring business logic validation

Technical summary

The vulnerability exists in ZTE products due to insufficient business logic validation. Attackers with administrative privileges can manipulate legitimate application workflows to achieve malicious outcomes not anticipated by the design. The attack vector is network-based with low attack complexity, but requires high-level privileges. Impact is limited to low integrity and availability effects with no confidentiality impact. The underlying weakness relates to improper credential or access control implementation classified under CWE-1240.

Defensive priority

routine

Recommended defensive actions

Review ZTE security bulletin for affected product versions and patch availability
Audit administrative function usage for anomalous patterns
Implement principle of least privilege for administrative accounts
Monitor for unexpected use of legitimate application capabilities
Verify business logic controls enforce intended workflow constraints

Evidence notes

NVD entry lists status as 'Deferred' with CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. ZTE PSIRT reference confirms vendor origin. CWE-1240 (Use of Hard-coded Passwords or Credentials) classified as secondary weakness source. Vendor identification marked low confidence requiring review despite ZTE evidence in reference domain.

Official resources

2026-05-26