External risk intelligence

Access Control Failure Allows Unauthorized System Data Access.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-49002

The vulnerability involves an access control failure in an application. While the network attack vector suggests potential reachability, the description does not specify that the product is a web-facing edge service or gateway. It is plausibly reachable from the internet in some deployments, but the context does not establish that public exposure is a common or default deployment pattern for this specific application.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An access control failure has been identified, allowing unauthorized users to potentially view and modify system configuration information. This vulnerability affects applications that do not properly verify user permissions, meaning that individuals without the necessary authorization could gain access to sensitive data. The main concern is confirming the relevance and exposure of this issue within our environment.

Unchecked permissions let unauthorized users access data.
Matters due to potential unauthorized data access.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could potentially access and modify sensitive configuration information by exploiting an access control failure. This vulnerability allows unauthorized users to bypass permission checks and gain elevated privileges, leading to significant data exposure and system compromise.

Accessible over the network.
Bypasses access controls.
Unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

An access control failure could allow unauthorized users to view and modify system configuration information when supported by the advisory.

System configuration data.
Unauthorized access over the network.
Compromised system settings.

Operational Fix

Recommended remediation, mitigation, and detection steps

This access control failure, if exploited, allows unauthorized users to view and modify configuration information, impacting data integrity and confidentiality. Application owners and platform teams are typically responsible for addressing vulnerabilities within their managed systems. The first practical step is to confirm the presence of the affected technology, assess its exposure and business criticality, identify the accountable owner, and then plan remediation based on the assessed risk.

Confirm application ownership and scope.
Verify system accessibility and business impact.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software associated with CVE-2026-49002?

CVE-2026-49002 affects the ZTE ICCP iSupport WebUI. This software component is typically used as a web-based interface for managing and configuring network equipment and infrastructure systems, acting as a portal for administrators to oversee device settings and operational status.

What does an access control failure mean for this vulnerability?

This vulnerability is classified as CWE-284, which refers to improper access control. In the context of this CVE, it means the application fails to verify whether a user has the correct permissions before granting access. Because these checks are bypassed, an unauthorized user can interact with system data or modify configuration settings as if they were an authorized administrator.

How does an attacker trigger CVE-2026-49002?

An attacker triggers this vulnerability by sending specially crafted requests over the network to the affected application. Because the system does not validate user identity or permission levels for these operations, the requests are processed even if the sender is unauthenticated. Simply interacting with the interface in a standard, authorized way does not trigger this flaw.

Do I need to worry if my device is on the internal network?

Halo Surface Signal indicates that while this issue is reachable over the network, it is not confirmed to be a web-facing edge service. Devices positioned on an internal, restricted network generally have a lower risk profile than those exposed directly to the internet. However, since internal access could still allow unauthorized users to modify system configurations, you should confirm if the interface is accessible to unintended segments of your network.

How should I respond to this threat advisory?

Start by identifying if your environment hosts the ZTE ICCP iSupport WebUI. If found, assess how the interface is deployed and who can access it. Document the business criticality of the system, assign an owner responsible for the configuration, and monitor official support bulletins for vendor-provided updates to secure the permission-checking mechanism.

References

support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/6783201397271…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.