The vulnerability is a broken access control flaw that allows an attacker to read and modify configuration information beyond the permissions granted to their user account. This can expose sensitive settings or alter system behaviour, leading to unauthorized configuration changes. The reported CVSS score of 9.1 highlights the severity of missing or inappropriate access checks.

Affected systems are ZTE’s ZXUniPOS NDS-LTE product. No specific version or build numbers are disclosed, so all deployments of this product should be assessed for the presence of the access‑control defect.

The risk level is high; with a CVSS score of 9.1 the flaw allows full disclosure and modification of configuration data. The flaw is not listed in CISA’s KEV catalog. Based on the description, the attack vector is likely remote via the web or network interface, though local exploitation is also plausible if an attacker can authenticate to the system. Because of the severity indicated by the CVSS score, organizations should treat this as a priority vulnerability.