PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44410 ZTE CVE debrief

A business logic vulnerability in ZTE products allows authenticated administrators to exploit legitimate application functions in unintended ways. The flaw stems from improper implementation of business logic controls (CWE-1240), enabling malicious use of authorized capabilities outside their designed scope. The vulnerability requires high privileges (PR:H) with network access, and has low impact on integrity and availability. ZTE has published a security bulletin addressing this issue.

Vendor
ZTE
Product
ZXUniPOS NDS-LTE
CVSS
LOW 3.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

ZTE product administrators, security teams managing ZTE infrastructure, and organizations with administrative access controls requiring business logic validation

Technical summary

The vulnerability exists in ZTE products due to insufficient business logic validation. Attackers with administrative privileges can manipulate legitimate application workflows to achieve malicious outcomes not anticipated by the design. The attack vector is network-based with low attack complexity, but requires high-level privileges. Impact is limited to low integrity and availability effects with no confidentiality impact. The underlying weakness relates to improper credential or access control implementation classified under CWE-1240.

Defensive priority

routine

Recommended defensive actions

  • Review ZTE security bulletin for affected product versions and patch availability
  • Audit administrative function usage for anomalous patterns
  • Implement principle of least privilege for administrative accounts
  • Monitor for unexpected use of legitimate application capabilities
  • Verify business logic controls enforce intended workflow constraints

Evidence notes

NVD entry lists status as 'Deferred' with CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. ZTE PSIRT reference confirms vendor origin. CWE-1240 (Use of Hard-coded Passwords or Credentials) classified as secondary weakness source. Vendor identification marked low confidence requiring review despite ZTE evidence in reference domain.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44410 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44410

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44410 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44410

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.