CVE-2026-49002

Full vulnerability record from the local CVENow database.

Description

Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.

Severity

CRITICAL

CVSS score

9.1 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-05-27 09:16:32.253000

Last modified

2026-10-26 00:10:00.150000

View original CVE JSON

{
  "id": "CVE-2026-49002",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T09:16:32.253",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information."
    },
    {
      "lang": "es",
      "value": "Fallo en el control de acceso significa que una aplicación no verifica eficazmente los permisos de acceso de los usuarios, de modo que usuarios no autorizados pueden acceder a datos del sistema más allá de sus permisos, como ver y modificar información de configuración."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ZTE",
          "product": "ZXUniPOS NDS-LTE",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "Versions < V24.40.40CP01 (excluding V24.30.40CP03, V24.40.40CP01)",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-27T13:40:30.105103Z",
          "id": "CVE-2026-49002",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/6783201397271515377",
      "source": "[email protected]"
    }
  ]
}