What is the CVSS score of CVE-2026-44409?

CVE-2026-44409 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of ZTE MU5250 are affected by CVE-2026-44409?

The ZTE MU5250 mobile broadband modem contains a critical access-control misconfiguration (CVE-2026-44409) that allows unauthenticated remote parties to retrieve protected subscriber and device data.

How to fix or mitigate CVE-2026-44409?

Within 24 hours, conduct asset inventory to identify all ZTE MU5250 modems in production environments, particularly those in customer-facing or sensitive-data roles, and document what protected data these devices can access. Within 7 days, implement network segmentation to restrict the MU5250 to trusted networks only, disable remote management features through firmware configuration if available, and establish monitoring to detect unauthorized access attempts. Within 30 days, contact ZTE to request patch timeline and interim firmware mitigation options, evaluate device replacement feasibility with patched alternatives, and communicate required upgrades to affected users with target remediation dates.

ZTE MU5250 CVE-2026-44409

EUVD-2026-31408 HIGH

Information Exposure (CWE-200)

2026-05-22 zte

GHSA-gcf2-x38g-f7w4

Information Disclosure Zte Mu5250

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Remote, unauthenticated, low-complexity read via missing access control (AV:N/AC:L/PR:N); C lowered to L to match SSVC 'partial' technical impact, with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 16:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 23, 2026 - 16:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 16:22 NVD

5.7 (MEDIUM) 7.5 (HIGH)

Analysis Generated

May 22, 2026 - 05:15 vuln.today

DescriptionNVD

There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.

AnalysisAI

Unauthorized information disclosure in the ZTE MU5250 mobile broadband modem (firmware BD_FLYMODEMMU5250V1.0.0B27) allows remote attackers to retrieve protected data because an access-control mechanism is improperly configured, exposing information without any authentication. No public exploit identified at time of analysis, and EPSS scores this at just 0.02% (5th percentile), consistent with CISA's SSVC assessment of no observed exploitation and only partial technical impact. Despite a network-reachable, no-authentication CVSS of 7.5, the vendor-reported issue reflects a device-specific misconfiguration rather than a broadly weaponized flaw.

Technical ContextAI

The MU5250 is a ZTE cellular/LTE broadband modem device (the firmware string BD_FLYMODEMMU5250 indicates a 'FLYMODEM' portable modem product line) that exposes a management/web interface. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): an access-control mechanism on the device is configured such that resources intended to be restricted are reachable without proper authorization checks. In practice, CWE-200 combined with 'improper configuration of the access control mechanism' typically means an endpoint, API, or status/config page returns sensitive data (device configuration, network parameters, credentials, or subscriber information) to any caller that requests it. The affected CPE is cpe:2.3:a:zte:mu5250:*:*:*:*:*:*:*:*, and only the specific firmware build BD_FLYMODEMMU5250V1.0.0B27 is enumerated by ENISA EUVD.

RemediationAI

Consult the ZTE security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343342 and apply the vendor's corrected firmware for the MU5250; the available data does not list a specific fixed build number, so treat this as 'Patch available per vendor advisory' and confirm the exact patched firmware version directly with ZTE before deployment rather than assuming a version. Until patched firmware is applied, reduce exposure by restricting network access to the device's management/web interface - bind or firewall it to the trusted LAN only and block reachability from the WAN/carrier side and untrusted networks, which prevents remote unauthenticated access at the cost of losing any intended remote management. If a specific status, API, or configuration endpoint is identified as the leak, place access-control rules (authentication requirement or IP allow-listing) in front of it via the device or an upstream gateway; the trade-off is added configuration and potential disruption to legitimate automated polling. Also rotate any credentials or sensitive parameters that may have been exposed through the disclosed information.