PT-2026-32281 · Zte · Zxedm Iems

Wenwei Shi · Published 2026-04-13 · Updated 2026-05-06 · CVE-2026-40436

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZTE ZXEDM iEMS (affected versions not specified)

Description The cloud EMS portal fails to properly control access to the user list acquisition function. This allows attackers to read all user list information through the user list interface and subsequently reset the passwords of any user, leading to risks of unauthorized operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-40436

Affected Products

Zxedm Iems

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-40436 · Security Note
• https://support.zte.com.cn/zte-iccp-isupport-webui/support/bulletin/security?lang=en_US&t=0.7465962531829456 · Vendor Advisory
• https://twitter.com/giuseppe_1337/status/2043596484117991549 · Twitter Post
• https://t.me/cveNotify/162424 · Telegram Post
• https://twitter.com/CVEnew/status/2043733065047126279 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043721928267964803 · Twitter Post