CVE-2026-49003

CriticalCVSS 9.6/10Last modified Sep 1, 2026

Description

Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tampering with critical system parameters and triggering abnormal operation of the entire power system.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
ZTE	ZXDU68 S202 V5.0	ZXDU68 S202 V5.0R02M02 ACB V1.30.01.00 、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.01、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.02、ZXDU68 S202 V5.0R02M02 ACB V1.30.01.03

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/874505866159002595

Timeline

Published: Aug 31, 2026
Last modified: Sep 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-490046.5The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service CVE-2026-490052.4The root password hash of the device can be obtained through unencrypted information in the firmware.CVE-2026-490065.3By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.CVE-2026-490077.5By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web inter CVE-2026-490086.5By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a s CVE-2026-490093.1Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.CVE-2026-49016.5AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further a CVE-2026-490147.8In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It rea CVE-2026-490176.5In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request bo CVE-2026-49028.8A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the compon CVE-2026-490284.8Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow CVE-2026-49038.8A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the