This vulnerability (CVE-2026-48999) in ZTE ZXUniPOS NDS-LTE is due to improper neutralization of input during web page generation, categorized under CWE-79 (Cross-Site Scripting). Attackers can inject malicious scripts that are stored and executed when other users access affected pages, enabling theft of cookies, hijacking of session privileges, and manipulation of page content. The affected versions include all versions before V24.40.40CP01 except V24.30.40CP03 and V24.40.40CP01. The CVSS 3.1 base score is 5.7, indicating medium severity with network attack vector, low attack complexity, high privileges required, user interaction required, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact. No patch or official remediation level has been provided by ZTE as of the publication date.

Successful exploitation allows attackers to execute malicious scripts in the context of other users' browsers, potentially leading to theft of user cookies, hijacking of session privileges, and unauthorized modification of web page content. The vulnerability impacts the integrity and availability of the affected system to a limited extent and confidentiality to a low extent. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply any recommended vendor mitigations if provided. Given the lack of an official patch or temporary fix, organizations should monitor vendor communications for updates. No specific mitigation steps are provided by the vendor at this time.