What is the CVSS score of CVE-2026-44409?

CVE-2026-44409 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

ZTE MU5250 CVE-2026-44409

EUVD-2026-31408 MEDIUM

Information Exposure (CWE-200)

2026-05-22 zte

GHSA-gcf2-x38g-f7w4

Information Disclosure Zte

5.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 05:15 vuln.today

DescriptionCVE.org

There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.

AnalysisAI

Unauthorized information disclosure in the ZTE MU5250 5G mobile router allows an adjacent-network attacker with low-privilege access to retrieve sensitive information due to misconfigured access control mechanisms. The vulnerability carries a CVSS 3.1 base score of 5.7 (Medium) with high confidentiality impact, confirmed by ZTE through their own security bulletin. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate mass-exploitation risk, though the high confidentiality impact (C:H) warrants timely remediation in network-sensitive deployments.

Technical ContextAI

The ZTE MU5250 is a 5G CPE/mobile router device, as evidenced by the firmware identifier 'BD_FLYMODEMMU5250V1.0.0B27' in EUVD data. The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the device's access control layer fails to enforce proper authorization checks before returning sensitive data - likely through an internal API endpoint, management interface, or diagnostic function that does not validate the privilege level or scope of the requesting principal. The CPE string (cpe:2.3:a:zte:mu5250:*:*:*:*:*:*:*:*) uses a wildcard version field, suggesting NVD has not bounded the affected version range beyond what EUVD specifies. The CVSS adjacent-network vector (AV:A) is consistent with the device being a local network appliance whose management plane is exposed only to the LAN/WLAN segment it serves.

RemediationAI

The primary remediation is to consult and apply the update referenced in ZTE's official security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343342. A specific patched firmware version has not been independently confirmed from the available data - administrators should verify the target firmware version directly from ZTE before upgrading. As a compensating control while awaiting patching, restrict access to the MU5250 management interface to trusted hosts only, and ensure the device is not exposed to untrusted users on the adjacent network segment. If the device is deployed in a shared network (enterprise WLAN, guest network), isolate it at Layer 2 using VLAN segmentation to limit which hosts can reach the management plane. Minimizing the privilege level of accounts that interact with the device reduces the pool of potential attackers, as PR:L indicates low-privilege credentials are sufficient for exploitation.