The ZTE ZXEDM iEMS product contains a vulnerability related to improper privilege management (CWE-269) in its cloud EMS portal. Due to insufficient access control on the user list acquisition function, an attacker with limited privileges and user interaction can retrieve the entire user list. Subsequently, the attacker can reset passwords for these users, potentially gaining unauthorized access and control over the system. This vulnerability affects version ElasticNet_UME_R32_V16.25.42.04 and has a CVSS 3.1 base score of 7.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation allows an attacker to read all user information from the user list interface and reset passwords for those users. This can lead to unauthorized operations within the ZTE ZXEDM iEMS system, compromising confidentiality, integrity, and availability of the affected system. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, user interaction required, and unchanged scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the cloud EMS portal and monitor for unauthorized access attempts. Avoid exposing the user list interface to untrusted networks. Follow vendor updates closely for any forthcoming patches or official mitigations.