CVE-2026-40436
Unauthorized Password Reset via User List Exposure in ZTE ZXEDM iEMS
Publication date: 2026-04-13
Last updated on: 2026-05-06
Assigner: ZTE Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zte | zxedm_iems | 16.25.42.04 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to read all user list information and reset passwords without proper authorization. This unauthorized access and control over user accounts can lead to data breaches and unauthorized operations, which may violate data protection requirements under standards like GDPR and HIPAA.
Specifically, the exposure of user information and the ability to reset passwords could compromise the confidentiality, integrity, and availability of personal data, potentially resulting in non-compliance with regulations that mandate strict access controls and protection of sensitive information.
Can you explain this vulnerability to me?
The vulnerability exists in the ZTE ZXEDM iEMS product's cloud EMS portal where the management does not properly control access to the user list acquisition function.
Because of this, attackers can read all user list information through the user list interface.
With the obtained user information, attackers can reset the passwords of those users, leading to unauthorized operations.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and control over user accounts because attackers can reset passwords without proper authorization.
Such unauthorized operations can compromise the confidentiality, integrity, and availability of the system.
The CVSS score of 7.1 indicates a high severity impact, meaning the vulnerability poses significant risks if exploited.