The flaw allows attackers to insert malicious JavaScript code that is permanently saved in the system. When other users open affected pages, the browser automatically runs the code, enabling cookie theft, session hijack, and tampering with displayed content. Because the code is stored on the server, the vulnerability can impact many users and remains hidden until a victim interacts with the compromised page.

The vulnerability is present in ZTE’s ZXUniPOS NDS‑LTE point‑of‑sale product, as disclosed by ZTE. No specific firmware or software version list was provided.

With a CVSS score of 5.7 the issue is considered moderate severity. Exploitation is possible through the web interface where attackers can supply crafted input; the attack is performed by a remote user and relies on the application’s failure to sanitize or encode stored content. The EPSS metric is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploits at the time of this analysis.