ZXUniPOS NDS-LTE CVE-2026-44410

Exploitation requires a network-reachable ZXUniPOS NDS-LTE instance running version V24.40.40 or V24.30.40CP02 AND authenticated access with high-privilege credentials (PR:H per CVSS vector). The high-privilege requirement is the primary limiting factor: an attacker must already possess or acquire administrator-level access to the platform, ruling out opportunistic unauthenticated attackers and limiting risk to insider threats or post-compromise lateral movement scenarios. No specific feature flag or non-default configuration is described in available data as an additional prerequisite beyond the authentication level. SSVC confirms 'Automatable: no', consistent with the manual credential-acquisition step required before exploitation.

All available signals converge on a very low real-world risk posture. The CVSS score of 3.8 (Low) is driven primarily by the PR:H requirement (high-privilege authenticated access), which sharply limits the attacker pool to already-trusted insiders or compromised administrator accounts. The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction required, but these factors are substantially offset by the privilege prerequisite. The EPSS score of 0.03% places this in the 7th percentile, meaning over 93% of CVEs have a higher exploitation probability. SSVC corroborates this: Exploitation is 'none', Automatable is 'no' (consistent with the high-privilege requirement preventing mass scanning), and Technical Impact is only 'partial'. No CISA KEV listing and no public exploit code further reduce urgency. One signal conflict warrants explicit note: the vulnerability tag 'Information Disclosure' is inconsistent with the CVSS C:N component; defenders should not treat this as a confirmed data-exfiltration risk unless the vendor clarifies. Overall, this is a low-priority finding appropriate for scheduled patch cycles rather than emergency response.

A threat actor who has obtained high-privilege credentials - through credential theft, insider access, or compromise of an administrative account - connects to the ZXUniPOS NDS-LTE management interface over the network and invokes legitimate application functions in an abnormal sequence or with malformed inputs not anticipated by the application's business logic. This causes unauthorized modification of configuration or operational data (integrity impact) and may disrupt application availability. No public exploit code exists at time of analysis, meaning exploitation requires manual knowledge of the application's internal logic.