Script Injection Vulnerability in ZTE Products

CVE-2026-48999

What is CVE-2026-48999?

This vulnerability allows attackers to inject malicious scripts, such as JavaScript, into vulnerable ZTE systems. When other users access affected pages, these scripts execute in their browsers, enabling attackers to steal sensitive data like cookies, hijack user sessions, and manipulate webpage content. The embedded nature of the malicious code provides significant concealment and increases the potential scale of attacks, making it a prevalent threat for data breaches.

References