A critical authorization bypass vulnerability in the ZTE ZXMP M721 permits low-privileged users to extract communication private keys, potentially compromising encrypted traffic.

This vulnerability involves the use of hard-coded cryptographic keys (CWE-321) that are exposed through an authorization bypass. The flaw allows any authenticated user with low privileges to access the device private key over the network.

The exposure of communication private keys represents a high-severity risk to network confidentiality. With a CVSS score of 7.7, this vulnerability facilitates the decryption of sensitive data, which could lead to widespread information disclosure and the loss of secure communication integrity. Organizations relying on this hardware for secure transport must treat this as a priority to prevent unauthorized interception of proprietary or sensitive traffic.

Immediate Action: Administrators must apply the official security patch provided by ZTE immediately to remediate the authorization bypass and secure the cryptographic keys.

Proactive Monitoring: Security teams should monitor system access logs for unauthorized attempts to access configuration interfaces or cryptographic management endpoints by low-privileged accounts.

Compensating Controls: Restrict network access to the management interface of the ZXMP M721 to trusted management subnets only, effectively limiting the attack surface available to unauthorized or compromised low-privileged accounts.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate attention, as the compromise of private keys fundamentally undermines the security of the entire communication chain. Organizations should verify their current firmware version against the affected build and coordinate an emergency maintenance window to apply the vendor-supplied fix. Failure to patch leaves the internal network communication susceptible to passive decryption and long-term intelligence gathering by threat actors.