The vulnerability is a CSRF flaw that allows an attacker to cause a user—who is already authenticated—to execute unintended operations within the ZTE ZXUniPOS NDS‑LTE system, such as modifying configuration data. The primary impact is unauthorized configuration changes, which could alter system behavior or compromise service availability. The weakness is classified as CWE‑352, a classic CSRF vulnerability that exploits the lack of proper request‑validation mechanisms.

ZTE ZXUniPOS NDS‑LTE management interface is affected. No explicit version information is provided; any deployment of the ZXUniPOS NDS‑LTE product is potentially vulnerable.

The CVSS score of 5.3 indicates a moderate severity, with attackers needing a user’s authenticated session and ability to craft a cross‑site request. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known widespread exploitation. The likely attack path involves an attacker hosting a malicious web page that issues forged requests while a legitimate user is logged into the POS management console. Successful exploitation would result in unauthorized configuration changes, potentially disrupting operations.