ZTE SCP CVE-2026-9668

Exploitation requires two concrete prerequisites: a valid low-privileged ZTE SCP user account (PR:L - the description explicitly states 'legitimate user credentials in hand'), and adjacent network access to the SCP management interface (AV:A - the attacker must share a network segment such as a management VLAN or internal operator network). No privilege escalation beyond a standard user account is needed prior to exploitation. Exploitation is limited to actors with internal or management-plane network access; internet-exposed exploitation is not indicated by the CVSS vector. The absence of integrity impact (I:N) indicates write operations are not confirmed via this path, constraining the attack to data exfiltration rather than data modification or deletion.

The CVSS 3.1 score of 6.3 reflects meaningful but bounded risk: adjacent-network positioning (AV:A) and pre-existing valid credentials (PR:L) are non-trivial prerequisites that significantly narrow the attacker population compared to a fully remote, unauthenticated flaw. The high confidentiality impact (C:H) indicates full or broad database read access, which is severe for a telecom management platform that may store subscriber records, authentication data, or network configuration. No EPSS score was provided in the available data, and this CVE does not appear in CISA KEV, meaning active exploitation has not been confirmed - the vulnerability should be treated as exploitable by insiders or lateral-movement actors rather than external threat actors. The unchanged scope (S:U) means this vector alone does not pivot to other systems, but the data accessible via the database can itself be of high strategic value. The low availability impact (A:L - query slowdown) is a secondary concern. Overall, this is a real internal risk warranting prompt patching, particularly for operators with low-trust internal network environments.

An insider or lateral-movement attacker with a valid low-privileged ZTE SCP account injects SQL payloads into user-controlled input fields in the SCP interface, causing the application to execute queries beyond the intended authorization boundary. This enables reading of sensitive database records - such as subscriber data, device credentials, or network configuration - that the account should not access. No public proof-of-concept has been identified, but low attack complexity (AC:L) means manual exploitation requires only basic SQL injection knowledge.