CVE-2026-40436

ZTE ZXEDM iEMS product has a password reset vulnerability

High · published April 13, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the user list interface. Attackers can reset the passwords of obtained user information, causing risks such as unauthorized operations.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Published
2026-04-13T06:31Z
EPSS history
Timeline
  • 13 APR 06:31Z
    ZTE ZXEDM iEMS product has a password reset vulnerability
    cvelistv5