CVE-2026-49xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

606 records · Page 7 of 7

• CVE-2026-49005: Root password hash exposure vulnerability in ZTE F689 product 2.4 Low

  The root password hash of the device can be obtained through unencrypted information in the firmware.

  Updated 2026-08-07
• CVE-2026-49004: PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product 6.5 Medium

  The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.

  Updated 2026-08-07
• CVE-2026-49003: Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product 9.6 Critical

  Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tampering with critical system parameters and triggering abnormal operation of the entire power system.

  Updated 2026-08-31
• CVE-2026-49002: Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product 9.1 Critical

  Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.

  Updated 2026-05-28
• CVE-2026-49001: Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product 5.3 Medium

  Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution of unintended operations such as tampering with configuration data.

  Updated 2026-05-28
• CVE-2026-49000: Cryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE product 7.0 High

  An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implementation, which may lead to data leakage or tampering, such as hard-coded keys or the use of weak encryption algorithms.

  Updated 2026-05-28

Search a CVE ID or check dependency files →