This vulnerability (CVE-2026-44410) in ZTE ZXUniPOS NDS-LTE is classified under CWE-1240, indicating the use of a cryptographic primitive with a risky implementation. The root cause is a business logic flaw that allows attackers to exploit legitimate application functions in unintended ways. The CVSS 3.1 base score is 3.8 (low severity), with network attack vector, low attack complexity, requiring high privileges, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. Affected versions include V24.40.40 and V24.30.40CP02. No patch or official remediation level is currently documented.

The impact is limited to low integrity and availability degradation without confidentiality loss. Exploitation requires high privileges and network access but no user interaction. There are no known exploits in the wild. The vulnerability could allow attackers with existing high privileges to misuse application functions to cause limited disruption or data integrity issues.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation level has been provided, organizations should monitor vendor communications for updates. Given the requirement for high privileges to exploit, enforcing strict access controls and privilege management may reduce risk.