# CVE-2026-49001: ZTE Products Cross-Site Request Forgery

Source: https://junglewise.ai/threats/cve-2026-49001-zte-products-cross-site-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-49001 · Severity: medium · CVSS 5.3 · Published 2026-05-27

A security vulnerability has been identified in certain ZTE products that could allow an attacker to trick an authenticated administrator into performing unintended actions. By exploiting a user's active session, an attacker could potentially modify system configurations or tamper with data. This could lead to unauthorized changes in how the device operates or impact the integrity of the system's settings.

Vendors: [Zte](https://junglewise.ai/threats/vendors/zte).

## Quick answers

**Is CVE-2026-49001 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49001 being exploited in the wild.

**How severe is CVE-2026-49001?** Medium severity, with a CVSS score of 5.3, published 27 May 2026.

**Which products and versions are affected?** ZTE ZTE Products.

**Is there a fix for CVE-2026-49001?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49001 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49001?** Check whether you run Zte Products. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) exists in certain ZTE products due to insufficient validation of cross-site requests. An attacker can exploit this by inducing an authenticated user with high privileges to visit a malicious website or click a crafted link while their session is active. Successful exploitation allows the attacker to forge requests that the application treats as legitimate, potentially leading to unauthorized configuration changes or data tampering. The attack requires high privileges (PR:H), user interaction (UI:R), and high complexity (AC:H) according to the provided CVSS vector. Users are advised to refer to ZTE's official support bulletins for specific product patches and mitigation steps.

## Affected products

- ZTE ZTE Products

## Timeline

- 2026-05-27: disclosed: Initial publication of the CVE record by ZTE Corporation.
- 2026-05-27: advisory: ZTE published a security bulletin regarding the CSRF vulnerability.

## References

- [https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343400](https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343400)