Zte · Zxedm Iems · CVE-2026-40436
**Name of the Vulnerable Software and Affected Versions**
ZTE ZXEDM iEMS (affected versions not specified)
**Description**
The cloud EMS portal fails to properly control access to the user list acquisition function. This allows attackers to read all user list information through the user list interface and subsequently reset the passwords of any user, leading to risks of unauthorized operations.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.