CVE-2025-46583: ZTE MC889A Pro · Improper Encoding or Escaping of Output
Affects ZTE MC889A ProSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 27 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
1. Monitor ZTE vendor communications for firmware updates or patches addressing CVE-2025-46583 and apply them promptly upon release. 2. Implement strict input validation and filtering at network boundaries to block malformed or suspicious SMS traffic targeting the vulnerable interface. 3. Restrict access to the SMS interface to trusted networks or authenticated users where possible, reducing exposure to unauthenticated attackers. 4. Deploy network intrusion detection/prevention systems (IDS/IPS) with signatures or heuristics to detect anomalous SMS traffic patterns. 5. Conduct regular security assessments and penetration testing on deployed ZTE MC889A Pro devices to identify potential exploitation attempts. 6. Maintain robust incident response plans to quickly isolate and remediate affected devices in case of DoS attacks. 7. Consider network segmentation to limit the impact of compromised or disrupted devices on broader infrastructure. 8. Engage with ZTE support to confirm device configurations and recommended security hardening practices specific to the MC889A Pro model.
Description
There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Service interface, allowing an attacker to exploit it to carry out a DoS attack.