« Volver al listado

CVE-2025-26709

Estado: AplazadaMedia (5.7)—

There is an unauthorized access vulnerability in ZTE F50. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

ZTE — F50AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-26709",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-26709",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-15T11:48:12.837924Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@zte.com.cn",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@zte.com.cn",
      "affectedData": [
        {
          "vendor": "ZTE",
          "product": "F50",
          "versions": [
            {
              "status": "affected",
              "version": "F50_FLYMODEM_ZYV1.0.0B07"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-15T11:15:28.720",
  "references": [
    {
      "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1288700446535356789",
      "source": "psirt@zte.com.cn"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@zte.com.cn",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is an unauthorized access vulnerability in ZTE F50. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface"
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de acceso no autorizado en el ZTE F50. Debido a un control de permisos inadecuado de la interfaz del módulo web, un atacante no autorizado puede obtener información confidencial a través de ella."
    }
  ],
  "lastModified": "2026-06-17T09:02:19.977",
  "sourceIdentifier": "psirt@zte.com.cn"
}