What is the CVSS score of CVE-2026-44408?

CVE-2026-44408 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

ZTE MU5250 CVE-2026-44408

EUVD-2026-30851 MEDIUM

Information Exposure (CWE-200)

2026-05-19 zte

GHSA-cwrg-crx8-vv9w

Information Disclosure Zte Authentication Bypass

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 09:31 vuln.today

DescriptionCVE.org

There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can modify configuration through the interface.

AnalysisAI

Improper permission control on the ZTE MU5250 web management interface allows an adjacent-network attacker with low-level credentials to modify device configuration beyond their authorized scope, resulting in high availability impact and low integrity impact. Affected firmware is confirmed as BD_FLYMODEMMU5250V1.0.0B27, self-disclosed by ZTE via their security bulletin. No public exploit code or CISA KEV listing exists at time of analysis, and exploitation is constrained to adjacent network access with some level of authenticated access per the CVSS vector.

Technical ContextAI

The ZTE MU5250 appears to be a fixed wireless or mobile broadband CPE device (likely 5G/LTE modem-router) based on ZTE's product naming convention. The vulnerability resides in its web-based management interface, which fails to enforce authorization boundaries between privilege levels - allowing a lower-privileged authenticated user to invoke configuration endpoints that should be restricted to higher-privilege roles. The assigned CWE is CWE-200 (Information Exposure), but this conflicts with the described impact of configuration modification; the root cause more accurately reflects CWE-284 (Improper Access Control) or CWE-862 (Missing Authorization). The discrepancy between the CWE assignment and the actual behavior described - unauthorized configuration changes rather than data disclosure - should be noted as a data quality issue in the NVD/EUVD records. The CPE string cpe:2.3:a:zte:mu5250:*:*:*:*:*:*:*:* covers all versions, but EUVD narrows the confirmed affected build to firmware version BD_FLYMODEMMU5250V1.0.0B27.

RemediationAI

The primary remediation action is to apply any firmware update issued by ZTE for the MU5250 that addresses this permission control flaw - consult the ZTE security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2657904255874650158 for the specific patched firmware version, as no explicit fix version number was provided in the available data. Until a patch is applied, restrict access to the device's web management interface by disabling remote web access if not required, and ensure the management interface is bound only to trusted network interfaces. Network-level controls such as firewall rules blocking HTTP/HTTPS access to the device's management port from untrusted adjacent segments provide a meaningful compensating control; however, these do not eliminate risk if the attacker is already on the same trusted LAN segment. Changing default credentials and minimizing the number of accounts with any level of authenticated access reduces the low-privilege attack surface. No side-effect concerns are expected from these access restrictions beyond loss of remote management convenience.