ZTE MC889A Pro CVE-2025-46583

Exploitation requires the attacker to reach the ZTE MC889A Pro's Short Message Service (SMS) interface and submit input parameters that are not properly validated; on a cellular CPE/hotspot device this typically means either sending a message to the device's SMS-handling function or interacting with its SMS management interface. No authentication is indicated by the CVSS vector (PR:N) and no user interaction is required (UI:N). Limiting factors: impact is confined to availability (A:L) - a service disruption/reboot, not code execution or data exposure - and practical exploitation may depend on the attacker being able to reach the specific device's SMS interface (e.g., knowing the SIM's phone number if delivery is over-the-air), which is narrower than a typical internet-facing network service.

This is a medium-severity (CVSS 5.3) availability-only Denial of Service flaw that signals are consistent in rating as a low-urgency issue rather than a top priority. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, but with only partial availability impact and zero confidentiality or integrity impact - i.e., degraded or interrupted service, not full compromise. EPSS is low (0.43%, 36th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent exploitation. One point warrants verification: the description attributes the flaw to the 'Short Message Service (SMS) interface,' which on a cellular CPE device is often reached by sending an SMS message to the device's SIM rather than over an IP network - this could make real-world exploitation depend on knowing/reaching the device's phone number, which is more constrained than a pure AV:N internet-facing service implies. Verify the actual delivery channel (over-the-air SMS vs. local web-UI SMS management page) with ZTE, as it materially changes exposure. Overall: a real but low-priority defect, best handled via routine firmware patching.

An attacker sends a crafted message or request with malformed parameters to the ZTE MC889A Pro's Short Message Service interface. Because the input parameters are not sufficiently validated, processing the malformed input disrupts the service and renders the device (or its SMS/connectivity function) unavailable until it recovers or is restarted. No public exploit code has been identified.