CVE-2026-44409: ZTE MU5250 Information Disclosure Flaw

CVE-2026-44409 Overview

CVE-2026-44409 is an information disclosure vulnerability affecting the ZTE MU5250 mobile router. The flaw stems from improper configuration of the access control mechanism on the device. An attacker positioned on an adjacent network with low-level privileges can retrieve sensitive information without proper authorization. The weakness is classified under [CWE-200], which covers exposure of sensitive information to unauthorized actors. Successful exploitation does not require user interaction and impacts confidentiality of data stored or processed by the device.

Critical Impact

Authenticated attackers on the same network segment as a ZTE MU5250 device can bypass access controls and read sensitive information without authorization.

Affected Products

• ZTE MU5250 mobile router (specific firmware versions referenced in the ZTE security bulletin)

Discovery Timeline

• 2026-05-22 - CVE-2026-44409 published to NVD
• 2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-44409

Vulnerability Analysis

The vulnerability resides in the access control logic of the ZTE MU5250. The device fails to enforce proper authorization checks when servicing requests for protected resources. An attacker with low privileges on the adjacent network can issue requests that the device should reject but instead processes and returns sensitive data.

The issue is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). The attack vector is Adjacent (AV:A), meaning the attacker must share a logical network with the target device, such as the Wi-Fi network broadcast by the router. The confidentiality impact is High, while integrity and availability remain unaffected.

Root Cause

The root cause is improper configuration of the access control mechanism within the MU5250 firmware. Authorization checks are either missing or insufficient on specific endpoints or interfaces that expose information. The device treats requests from low-privilege adjacent users as permitted to access resources reserved for higher-privilege roles.

Attack Vector

Exploitation requires network adjacency, such as connection to the router's Wi-Fi network, plus low-privilege credentials. The attacker sends crafted requests to the device's management or service interface. Because access control is misconfigured, the device returns information that should remain restricted. No user interaction is required. Detailed technical specifics are available in the ZTE Security Bulletin.

Detection Methods for CVE-2026-44409

Indicators of Compromise

• Unexpected HTTP or API requests to ZTE MU5250 management interfaces from low-privilege user accounts on the local Wi-Fi network.
• Access log entries showing successful responses to endpoints that normally require administrative privileges.
• Unusual volumes of configuration or status data returned to non-admin clients.

Detection Strategies

• Inspect device access logs for requests to sensitive endpoints originating from non-administrative sessions.
• Monitor traffic on the wireless segment for HTTP responses containing configuration or identity data sent to unauthorized clients.
• Correlate authentication events with subsequent resource access to identify privilege boundary violations.

Monitoring Recommendations

• Forward MU5250 logs to a centralized logging or SIEM platform for retention and analysis.
• Alert on repeated requests from the same client to administrative paths within a short time window.
• Track and review the list of devices associated with the router's wireless network for unrecognized clients.

How to Mitigate CVE-2026-44409

Immediate Actions Required

• Apply the firmware update provided in the ZTE Security Bulletin for the MU5250.
• Restrict access to the device's Wi-Fi network using a strong WPA2 or WPA3 passphrase and limit the number of authorized users.
• Change default and shared credentials used for any low-privilege accounts on the device.

Patch Information

ZTE has published a security bulletin for this issue. Refer to the ZTE Security Bulletin for the specific affected firmware versions and the fixed build to apply to the MU5250.

Workarounds

• Disable any guest network feature on the MU5250 to reduce the pool of adjacent attackers.
• Place the device on a dedicated network segment and prohibit untrusted clients from connecting.
• Rotate Wi-Fi credentials and review the list of connected clients regularly until the firmware update is applied.