ZTE ZXMP M721 CVE-2025-46582

Requires a valid low-privileged authenticated account on the ZTE ZXMP M721 management interface (CVSS PR:L); given such access, the attacker exploits a missing/broken authorization check to read the device's communication private key - no user interaction and no special non-default configuration is described. The principal limiting factor is the need for prior authenticated access to the device (not internet-anonymous): exposure is therefore bounded to environments where an attacker can obtain or coerce a low-tier operator credential, and to management-plane reachability of the ZXMP M721, which in typical telecom deployments sits on a restricted operations network rather than the public internet.

This is a moderate-priority issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) indicates a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privileged account (PR:L) - so it is not a pre-auth remote compromise. The scope change (S:C) and pure confidentiality impact (C:H, I:N, A:N) correctly reflect that the damage is disclosure of a cryptographic private key whose exposure undermines the confidentiality of communications beyond the device itself, rather than code execution or availability loss. Exploitation status: no public exploit identified at time of analysis - the CVE is not in CISA KEV and no POC is referenced. The EPSS score of 0.34% (25th percentile) is low, which is coherent with a vendor-self-reported (psirt@zte.com.cn) flaw in niche carrier-grade optical transport equipment that is not mass-scanned. No conflicting signals are present, but note the CWE-321 (hard-coded cryptographic key) assignment sits awkwardly with the description's emphasis on an authorization-bypass to 'view' the key - verify with ZTE whether the root cause is a static/hard-coded key or a broken access-control check, as that materially changes remediation.

An attacker who already holds a low-privileged account on a ZTE ZXMP M721 element - for example a limited operator login or a compromised monitoring credential - abuses a broken authorization check to read the device's communication private key, which they are not supposed to access. With that key, the attacker can decrypt or impersonate the device's protected communications, undermining the confidentiality of the managed optical transport channel. No public exploit code is known, and exploitation requires valid (if minimal) authenticated access.