{"id":"CVE-2026-44409","state":"PUBLISHED","title":"Information disclosure vulnerability in ZTE MU5250","description":"There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.","publishedAt":"2026-05-22T03:49:56.231Z","updatedAt":"2026-05-22T13:47:14.731Z","severity":{"score":5.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"zte"},"assigner":"zte","products":["ZTE MU5250"],"affected":[{"vendor":"ZTE","product":"MU5250","defaultStatus":"unaffected","versions":[{"version":"BD_FLYMODEMMU5250V1.0.0B27","status":"affected"}]}],"references":["https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343342"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/44xxx/CVE-2026-44409.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-44409","state":"PUBLISHED","datePublished":"2026-05-22T03:49:56.231Z","dateUpdated":"2026-05-22T13:47:14.731Z","assignerShortName":"zte","assignerOrgId":"6786b568-6808-4982-b61f-398b0d9679eb","dateReserved":"2026-05-06T08:50:27.676Z"},"containers":{"cna":{"title":"Information disclosure vulnerability in ZTE MU5250","descriptions":[{"lang":"en","value":"There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure."}],"affected":[{"vendor":"ZTE","product":"MU5250","defaultStatus":"unaffected","versions":[{"version":"BD_FLYMODEMMU5250V1.0.0B27","status":"affected"}]}],"references":[{"url":"https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343342"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":5.7,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","type":"CWE"}]}],"providerMetadata":{"shortName":"zte","orgId":"6786b568-6808-4982-b61f-398b0d9679eb","dateUpdated":"2026-05-22T03:49:56.231Z"},"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"credits":[{"lang":"en","value":"Duc Anh Nguyen （from NTCS&TinyxLab）","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-22T13:47:06.737611Z","id":"CVE-2026-44409","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-22T13:47:14.731Z"}}]}}}