The ZTE ZXEDM iEMS product allows any authenticated or unauthenticated user to obtain the full list of user accounts from the cloud EMS portal because the system does not enforce proper access controls on the user‑list endpoint. Once an attacker has the list, they can reset the passwords of those accounts, effectively taking over those user identities and gaining unauthorized control over the device. This flaw is a classic example of an authorization bypass that enables privilege escalation and arbitrary operation on the managed network device.

All installations of ZTE’s ZXEDM iEMS, including the version referenced by the CPE statement (16.25.42.04), are potentially vulnerable. The advisory does not specify a narrower version bound, so operators should assume the entire product family is affected until an update is applied.

The CVSS base score of 7.1 signals high severity. Exploitation can be carried out remotely via the EMS web interface, requiring no special credentials beyond access to the portal. The EPSS score is below 1%, indicating a very low probability of widespread exploitation, and the vulnerability is not present in the CISA KEV catalog. Nonetheless, the potential to gain full control of the device makes it a significant risk for operators who have not yet deployed a vendor patch.