Executive brief
The ZTE MU5250, a portable 5G Wi-Fi hotspot, contains a security flaw in its web management interface. An attacker with access to the local network can bypass certain permission checks to modify the device's configuration. This could lead to service disruptions or unauthorized changes to network settings, potentially impacting the connectivity and security of users relying on the hotspot.
Technical details
An unauthorized access vulnerability exists in the ZTE MU5250 portable hotspot due to improper permission control within the web management interface. The flaw is categorized under CWE-200 (Exposure of Sensitive Information) and improper access control, allowing an attacker with low privileges and adjacent network access to modify device configurations. According to the CVSS vector, the primary impact is on availability (High) and integrity (Low), suggesting that configuration changes could be used to disable the device or alter its operational state. No user interaction is required for exploitation.
Affected products
- ZTE MU5250
Timeline
- 2026-05-19: disclosed
- 2026-05-19: advisory