CVE-2026-49001 is a CSRF vulnerability in ZTE ZXUniPOS NDS-LTE that enables attackers to leverage a victim's authenticated session to forge cross-site requests. This can result in unintended actions, including modification of configuration settings. The vulnerability affects versions earlier than V24.40.40CP01, except for V24.30.40CP03 and V24.40.40CP01. The CVSS 3.1 base score is 5.3, indicating medium severity, with attack vector network, high attack complexity, requiring high privileges and user interaction, and impacts confidentiality (low), integrity (high), and availability (low). No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to perform unauthorized operations within the context of an authenticated user, potentially leading to tampering with configuration data. The impact on confidentiality is low, integrity is high, and availability is low. The vulnerability requires the attacker to have high privileges and the victim to interact with a crafted request, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply best practices to mitigate CSRF risks, such as ensuring proper anti-CSRF tokens are implemented and restricting high-privilege user actions. Monitor vendor communications for updates on patches or official mitigations.