CVE-2026-44410lowCWE-1240

CVE-2026-44410: low-severity vulnerability in ZTE ZXUniPOS NDS-LTE

Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE

Published · Updated

Follow this CVE+ Monitor ZXUniPOS NDS-LTE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.8epss 0.1%
In short

A flaw in ZTE ZXUniPOS NDS-LTE allows attackers to misuse legitimate features of the application in ways not intended by designers, potentially causing harm.

Technical detail

This business logic vulnerability in ZTE ZXUniPOS NDS-LTE permits attackers to invoke legitimate application functions in abnormal sequences or with unexpected parameter combinations, deviating from design constraints. The vulnerability requires application access and allows circumvention of intended operational workflows, resulting in unauthorized application behavior.

Summary generated and translated by AI from the official description.
This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Affected products
ZTE · ZXUniPOS NDS-LTE
Related CVEs — ZTE ZXUniPOS NDS-LTE

In the same product, most dangerous first.

CVE-2026-49002CRITICALBroken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE productEPSS 0.3%CVE-2026-48999MEDIUMStored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE productEPSS 0.2%CVE-2026-49000HIGHCryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE productEPSS 0.1%CVE-2026-49001MEDIUMCross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE productEPSS 0.1%