PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49000 ZTE CVE debrief

A medium-severity vulnerability (CVSS 5.3) involving insecure cryptographic practices was published on May 27, 2026. The issue stems from improper selection of encryption algorithms, inadequate key management, or flawed implementation—such as hard-coded keys or weak encryption—that could lead to data leakage or tampering. The vulnerability is associated with ZTE based on vendor evidence in the source reference, though product identification remains unconfirmed and requires review. No known exploitation in ransomware campaigns has been documented, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Vendor
ZTE
Product
ZXUniPOS NDS-LTE
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Security teams managing ZTE infrastructure, cryptographic engineers, compliance officers responsible for encryption standards, and incident response teams monitoring for data exfiltration or tampering indicators.

Technical summary

The vulnerability encompasses a class of cryptographic implementation flaws including improper algorithm selection, inadequate key management, and code-level defects such as hard-coded cryptographic keys. The attack requires network access but is mitigated by high complexity, privileged access requirements, and user interaction. Successful exploitation yields high confidentiality impact with limited integrity and availability consequences.

Defensive priority

medium

Recommended defensive actions

  • Review cryptographic implementations for hard-coded keys or weak algorithm usage
  • Audit key management practices across affected systems
  • Monitor ZTE security bulletins for product-specific patches
  • Apply principle of least privilege to limit exposure from high-privilege requirements
  • Implement defense-in-depth monitoring for anomalous cryptographic operations

Evidence notes

Vendor attribution to ZTE is based on the source reference domain and PSIRT contact email, marked with low confidence pending product identification. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L) indicates network attack vector with high attack complexity, requiring high privileges and user interaction, with high confidentiality impact but limited integrity and availability impact. CWE-310 (Cryptographic Issues) is cited as the weakness type.

Official resources

The CVE was published on May 27, 2026, with vendor notification attributed to ZTE's PSIRT. The NVD entry shows a status of 'Received,' indicating initial processing. A vendor security bulletin is referenced as the primary source of detailed