The vulnerability results from an improper configuration of the access control mechanism in ZTE MU5250, allowing attackers to retrieve sensitive data without proper authorization. This weakness is a classic information disclosure flaw (CWE-200) that permits remote viewing of system information, potentially exposing configuration details or other confidential data. The impact depends on the sensitivity of the disclosed data; it could lead to compromised privacy, operational insight, or further exploitation if exposed credentials are included.

The affected product is the ZTE MU5250. No specific firmware or hardware revisions were enumerated in the CNA data, so all versions of the MU5250 are potentially vulnerable unless the vendor has issued a patch or mitigation note.

The CVSS score of 5.7 indicates a moderate severity vulnerability, with a moderate impact to confidentiality. Since no EPSS score is available, the likelihood of exploitation is uncertain; the vulnerability is not referenced in the CISA KEV catalog. Based on the description, it is inferred that attackers may exploit the flaw by connecting to the device’s exposed management interfaces over the network, leveraging the missing authentication enforcement. No special prerequisites such as elevated privileges are mentioned, suggesting that remote unauthenticated access could suffice. Overall, the threat is credible, especially in environments where the device’s management interface is reachable from untrusted networks.