The vulnerability involves an insecure password scheme due to improper cryptographic algorithm selection or key management, allowing hard‑coded keys or weak encryption to be exploited. This flaw can lead to unauthorized data disclosure and integrity compromise of sensitive information stored or transmitted by the device.

ZTE’s ZXUniPOS NDS‑LTE product is affected. No specific version numbers were provided in the data, so all released firmware for this model should be evaluated.

With a CVSS score of 7, the risk is high; the EPSS score is unknown and the flaw is not listed in the CISA KEV catalog. The likely attack vector is inferred to involve local or remote exploitation of the device’s authentication mechanisms, where an attacker could use or override the weak password scheme to gain data‑access or tampering capabilities.