ZXUniPOS NDS-LTE EUVD-2026-32152

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special privileges are required - the limiting prerequisite is network reachability of the ZXUniPOS NDS-LTE interface that exposes the affected, improperly-protected functionality, on a vulnerable build (V24.40.40 / V24.30.40CP02 or earlier). The main factors that limit real-world exploitation are deployment-related rather than technical: ZXUniPOS NDS-LTE is a telecom operator-side platform that is normally segmented inside operator management networks and not internet-facing, so an attacker must already be positioned to reach that interface. Impact is bounded to confidentiality and integrity of configuration data (C:H/I:H); there is no availability impact (A:N), so this does not by itself enable service disruption.

Signals here are mixed and should be weighed together. CVSS 9.1 is driven by an exposed, low-complexity, unauthenticated network vector (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact (C:H/I:H) but explicitly no availability impact (A:N), which fits a data-disclosure-and-tampering bug rather than a service-takedown bug. However, EPSS is only 0.03% (9th percentile), it is NOT listed in CISA KEV, and no proof-of-concept is referenced - so despite the high base score, observed/predicted real-world exploitation is currently low. This is most consistent with a genuinely serious but not-yet-weaponized issue: prioritize patching because exploitation prerequisites are minimal, but the absence of KEV/POC and the niche, typically non-internet-facing nature of a telecom operator platform suggest exploitation would be targeted rather than mass/automated. Note one tension to verify: the description speaks generically of 'unauthorized users' (which could read as authenticated-but-over-privileged), while the CVSS vector asserts PR:N (no privileges) - the analysis follows the vendor-provided CVSS, but defenders should confirm with ZTE whether any account is needed.

An attacker with network access to an exposed ZXUniPOS NDS-LTE interface sends requests directly to permission-gated functions without holding valid credentials, and the missing access-control check allows the requests to succeed. The attacker then reads sensitive configuration data and modifies configuration values, undermining integrity of the platform. No public exploit is identified at time of analysis, and given AV:N/AC:L the action requires no special skill or user interaction once the interface is reachable.