This vulnerability is a business logic flaw that allows attackers to abuse legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations and enabling malicious attacks. No explicit details about the specific malicious outcome are provided in the advisory, so the precise impact remains unspecified beyond the potential for abuse of legitimate functions.

The affected product is ZTE ZXUniPOS NDS‑LTE from ZTE. No version information is provided.

The CVSS score of 3.8 indicates low severity. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV. The attack vector is not explicitly stated, but the description implies that the attacker must gain access to the application through legitimate functions; this may require valid credentials or network access to the POS system. The likelihood of exploitation is indeterminate due to lack of EPSS data, but the low CVSS suggests limited risk.