CVE-2026-44408

MediumCVSS 6.3/10Last modified Jul 24, 2026

Description

There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can modify configuration through the interface.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
ZTE	MU5250	BD_FLYMODEMMU5250V1.0.0B27

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2657904255874650158

Timeline

Published: May 19, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-444097.5There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers CVE-2026-44418.8Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2026-444103.8This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, CVE-2026-444117.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is vulnerable to uniniti CVE-2026-444127.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based o CVE-2026-444137.5In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access CVE-2026-444146.8A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device CVE-2026-444159.1Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remot CVE-2026-444169.8Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended CVE-2026-444177.5The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code CVE-2026-444188.7EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query CVE-2026-44428.8Heap buffer overflow in CSS in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a