Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48999— Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product

Quick assessment

Affected
ZTE ZXUniPOS NDS-LTE
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZTE ZXUniPOS NDS-LTE是中国中兴通讯（ZTE）公司的一款运营商网络定位平台。 ZTE ZXUniPOS NDS-LTE存在安全漏洞，该漏洞源于攻击者精心构造恶意脚本并注入目标系统，当其他用户访问包含恶意内容的页面时脚本自动加载执行，可能导致窃取用户cookie、劫持会话权限和篡改页面内容。

CVSS 5.7 · Medium EPSS 0.30% · P20

Affected Version Matrix 1

VendorProduct Version RangeStatus
ZTE ZXUniPOS NDS-LTE Versions < V24.40.40CP01 (excluding V24.30.40CP03, V24.40.40CP01) affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48999

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product
Source: CVE Program / CVE List V5
Vulnerability Description
Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers can thereby steal user cookies, hijack session privileges, and tamper with page content.Since the malicious code is stored within the system, the attack scope is broad and the concealment is strong, making it frequently employed for data theft attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
ZTE ZXUniPOS NDS-LTE 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ZTE ZXUniPOS NDS-LTE是中国中兴通讯（ZTE）公司的一款运营商网络定位平台。 ZTE ZXUniPOS NDS-LTE存在安全漏洞，该漏洞源于攻击者精心构造恶意脚本并注入目标系统，当其他用户访问包含恶意内容的页面时脚本自动加载执行，可能导致窃取用户cookie、劫持会话权限和篡改页面内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
ZTE ZXUniPOS NDS-LTE Versions < V24.40.40CP01 (excluding V24.30.40CP03, V24.40.40CP01) -

II. Public POCs for CVE-2026-48999

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-48999

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-48999 (1)

Same Patch Batch · ZTE · 2026-05-27 · 4 CVEs total

CVE-2026-49002 9.1 CRITICAL Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product
CVE-2026-49000 7.0 HIGH Cryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE product
CVE-2026-49001 5.3 MEDIUM Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product

IV. Related Vulnerabilities

Same product: ZXUniPOS NDS-LTE
Same vendor: ZTE
Same weakness: CWE-79

V. Comments for CVE-2026-48999

No comments yet

Leave a comment