The ZTE MU5250 device, specifically version BD_FLYMODEMMU5250V1.0.0B27, contains an information disclosure vulnerability (CWE-200) due to improper configuration of its access control mechanism. This misconfiguration permits attackers with low privileges and network access (attack vector: adjacent network) to access sensitive information without authorization. The vulnerability does not impact integrity or availability but has a high impact on confidentiality. The CVSS 3.1 base score is 5.7, reflecting medium severity. No vendor advisory or patch is currently available, and no known exploits have been reported.

Attackers with low privileges and network access can exploit this vulnerability to obtain sensitive information from the affected ZTE MU5250 device without authorization. This exposure compromises confidentiality but does not affect integrity or availability. The medium severity rating reflects the moderate risk posed by this information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been provided by ZTE, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device and limiting privileges may reduce exposure risk.