What is the CVSS score of CVE-2026-49007?

CVE-2026-49007 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of ZTE Network Device are affected by CVE-2026-49007?

ZTE network devices contain hardcoded plaintext credentials embedded in publicly available firmware; no public exploit identified at time of analysis, but any attacker obtaining the firmware can…

Is there a public PoC exploit available for CVE-2026-49007?

Yes, a public proof-of-concept exploit is available for CVE-2026-49007. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-49007?

Within 24 hours: Inventory all ZTE devices in production and identify those with internet-exposed or internal-network-accessible management interfaces; retrieve current firmware versions from affected devices. Within 7 days: Immediately restrict network access to ZTE device management interfaces using firewall rules, VLAN segmentation, or access controls to allow only authorized administrative workstations; implement robust logging and monitoring of all management interface access attempts. Within 30 days: Establish continuous monitoring for ZTE security advisories and patch releases; evaluate alternative network equipment vendors to reduce long-term reliance on ZTE products; conduct a full audit of device configurations and access logs for any signs of unauthorized access or configuration changes.

ZTE Network Device CVE-2026-49007

EUVD-2026-54408 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-08-07 psirt@zte.com.cn

GHSA-8798-3pf8-6h9q

Authentication Bypass

7.5

CVSS 3.1 · Vendor: zte

Severity by source

Vendor (zte) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

AV:N accepted provisionally assuming public firmware download; PR:N because credentials are obtained before any authentication; C:H for full credential disclosure; I and A remain N as the flaw itself does not modify or disrupt.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (zte).

CVSS VectorVendor: zte

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 08:31 vuln.today

CVE Published

Aug 07, 2026 - 08:16 cve.org

HIGH 7.5

DescriptionCVE.org

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.

AnalysisAI

Hardcoded plaintext credentials embedded in ZTE device firmware expose the web management interface to unauthorized access. The initial login credentials for the device's web interface are stored unencrypted within the firmware image, allowing any party who obtains the firmware to authenticate to any affected device. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the trivial nature of credential extraction from downloadable firmware files significantly elevates practical risk beyond what EPSS alone may reflect.

Technical ContextAI

CWE-798 (Use of Hard-coded Credentials) describes a class of flaws where a product contains credentials - such as a password or cryptographic key - that are statically embedded in the code or firmware and cannot be changed by the operator without vendor intervention. In this case, the initial web interface login credentials are stored in unencrypted form within the device firmware binary. ZTE network devices (routers, modems, CPE equipment) expose a web management interface for administration; credentials protecting this interface are recoverable by anyone who can access and parse the firmware image. The CVSS AV:N vector implies the firmware is obtainable without physical access - consistent with ZTE and most networking vendors publishing firmware images publicly for download - allowing offline extraction of credentials before targeting any internet-exposed device.

RemediationAI

Consult the ZTE security advisory at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982035232 for the specific patched firmware version - no exact fix version was available in the provided input data, so citing a version here would be speculative. As an immediate compensating control, change the default web interface credentials upon device deployment if the platform permits this; note that this mitigates the authentication bypass but does not eliminate the underlying plaintext storage flaw. Restrict access to the web management interface by firewall rule or ACL so it is not reachable from untrusted networks or the public internet, which reduces the exposure window even if credentials are known. Disable remote web management entirely if not operationally required. Monitor authentication logs for unexpected login attempts using default credential patterns. Patch availability per vendor advisory should be independently confirmed before assuming a fix exists.