CVE-2026-49008
Received Received - Intake

Hard-Coded Credentials in ZTE Device Firmware

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: ZTE Corporation

Description
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-49008
EUVD
EUVD-2026-54410

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an attacker accessing unencrypted information in device firmware to obtain credentials used for verifying the integrity of a specific application function on the device.

Impact Analysis

An attacker could exploit this to gain unauthorized access or manipulate application functions by obtaining integrity verification credentials, potentially leading to system compromise or data tampering.

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive data and system integrity, such as GDPR's data security principles or HIPAA's safeguards for protected health information.

Mitigation Strategies

Update device firmware to the latest version to ensure credentials are properly encrypted. Disable unnecessary services that may expose unencrypted information. Monitor network traffic for suspicious activity related to firmware access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49008. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart