149 lines
5.7 KiB
JSON
149 lines
5.7 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-44409",
|
||
"assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "zte",
|
||
"dateReserved": "2026-05-06T08:50:27.676Z",
|
||
"datePublished": "2026-05-22T03:49:56.231Z",
|
||
"dateUpdated": "2026-05-22T13:47:14.731Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "6786b568-6808-4982-b61f-398b0d9679eb",
|
||
"shortName": "zte",
|
||
"dateUpdated": "2026-05-22T03:49:56.231Z"
|
||
},
|
||
"title": "Information disclosure vulnerability in ZTE MU5250",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-200",
|
||
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-1",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "ZTE",
|
||
"product": "MU5250",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "BD_FLYMODEMMU5250V1.0.0B27"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.</p>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343342"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"attackVector": "ADJACENT_NETWORK",
|
||
"attackComplexity": "LOW",
|
||
"privilegesRequired": "LOW",
|
||
"userInteraction": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "NONE",
|
||
"availabilityImpact": "NONE",
|
||
"baseSeverity": "MEDIUM",
|
||
"baseScore": 5.7,
|
||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
|
||
}
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Duc Anh Nguyen （from NTCS&TinyxLab）",
|
||
"type": "finder"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"x_generator": {
|
||
"engine": "Vulnogram 1.0.2"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-05-22T13:47:06.737611Z",
|
||
"id": "CVE-2026-44409",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-05-22T13:47:14.731Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |