CVE-2026-49001 — Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product

CVE-2026-49001

Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product PUBLISHED

Description (CNA)

Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution of unintended operations such as tampering with configuration data.

Affected (CNA)

Vendor / product	Versions
ZTE / ZXUniPOS NDS-LTE	affected Versions < V24.40.40CP01 (excluding V24.30.40CP03, V24.40.40CP01)

CWE

CWE-352

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343400

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.