This vulnerability (CVE-2026-48999) is an improper neutralization of input during web page generation (CWE-79) in ZTE ZXUniPOS NDS-LTE. It enables attackers to inject and store malicious scripts such as JavaScript, which execute in the browsers of users who visit affected pages. The vulnerability affects versions V24.30.40CP02 and V24.40.40. The CVSS 3.1 base score is 5.3, with attack vector network, high attack complexity, high privileges required, user interaction required, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact. The vendor has not provided a patch or official remediation level, and this is not a cloud service. There are no known exploits in the wild at this time.

Successful exploitation can lead to execution of malicious scripts in users' browsers, enabling attackers to steal cookies, hijack session privileges, and tamper with page content. Because the malicious code is stored within the system, the attack can affect multiple users and is difficult to detect. The confidentiality impact is low, integrity impact is high, and availability impact is low according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply strict input validation and output encoding on affected systems if possible. Monitor for suspicious activity related to script injection. No vendor-provided official fix or temporary workaround is currently documented.