CVE-2026-49000

HighCVSS 7.0/10Last modified Jul 24, 2026

Description

An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implementation, which may lead to data leakage or tampering, such as hard-coded keys or the use of weak encryption algorithms.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
ZTE	ZXUniPOS NDS-LTE	Versions < V24.40.40CP01 (excluding V24.30.40CP03, V24.40.40CP01)

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343394

Timeline

Published: May 27, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-490015.3Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, in CVE-2026-490029.1Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access s CVE-2026-490039.6Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and beco CVE-2026-490046.5The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service CVE-2026-490052.4The root password hash of the device can be obtained through unencrypted information in the firmware.CVE-2026-490065.3By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.CVE-2026-490077.5By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web inter CVE-2026-490086.5By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a s CVE-2026-490093.1Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.CVE-2026-49016.5AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further a CVE-2026-490147.8In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It rea CVE-2026-490176.5In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request bo