CVE-2026-49001: Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product
Published May 27, 2026
·Updated
Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution of unintended operations such as tampering with configuration data.
Affected Software
1 affected component
ZTE ZXUniPOS NDS-LTE
Event History
May 27, 2026
CVE Published
via MITRE·07:33 AM
Data Sourced
via MITRE·07:33 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-49001?
The severity of CVE-2026-49001 is medium with a score of 5.3.
2
What type of vulnerability is CVE-2026-49001?
CVE-2026-49001 is a Cross-Site Request Forgery (CSRF) vulnerability.
3
How can I mitigate CVE-2026-49001?
To mitigate CVE-2026-49001, implement anti-CSRF tokens and ensure that sensitive operations require additional verification.
4
What impact does CVE-2026-49001 have on ZTE ZXUniPOS NDS-LTE?
CVE-2026-49001 allows attackers to exploit authenticated sessions to perform unintended operations on ZTE ZXUniPOS NDS-LTE.
5
When was CVE-2026-49001 published?
CVE-2026-49001 was published on May 27, 2026.