The ZTE ZXEDM iEMS product allows any user to reset passwords because the cloud EMS portal does not enforce proper access control over the user list acquisition function. An attacker who can read the user list can then reset the passwords of the returned accounts, granting the attacker unauthorized operations on the system. This flaw enables attackers to elevate privileges or take full control of managed devices without legitimate credentials.

The vulnerability applies to ZTE's ZXEDM iEMS product. No specific versions are listed, so all deployed instances of this product are potentially affected until a patch is applied.

The CVSS base score of 7.1 indicates a high severity vulnerability. Exploitation requires access to the cloud EMS portal; the description suggests it can be performed remotely via that interface. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but its high impact and lack of controls make it a significant risk for operators who have not yet applied a vendor fix.