ZTE Z80 Ultra CVE-2026-108503

Requires local access to a ZTE Z80 Ultra, realistically via a malicious or untrusted application the victim installs and runs, which then invokes the system's exposed callable functions that lack access control. Exploitation is limited by: the local-only attack vector (AV:L - no remote/network path), the need for user interaction (UI:R, e.g. installing/launching the attacker's app), and a narrow impact ceiling (confidentiality-only read of information, with no integrity or availability effect). It is further constrained to the specific affected ZTE Z80 Ultra device and firmware.

This is a low-severity, low-priority issue. The vendor-provided CVSS of 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a local attack vector (AV:L) requiring user interaction (UI:R), with only low confidentiality impact and no integrity or availability impact - consistent with the description's 'read relevant information' and CWE-276 (incorrect default permissions). No EPSS score, CISA KEV listing, SSVC decision, or POC was supplied in the intelligence, so there are no signals elevating this beyond its intrinsic low base score. The absence of these signals is consistent with a minor, locally-exploitable information-read flaw on a single smartphone model rather than a widely-targeted vulnerability. One point of friction worth verifying with the vendor: the input Tags label this 'Privilege Escalation,' but the description, CWE-276, and the C:L/I:N/A:N impact profile all describe information disclosure, not privilege escalation - treat the technique label with caution.

A user is induced to install a malicious or over-trusting application on a ZTE Z80 Ultra. Because the system's callable functions lack sufficient access control, that local app invokes them to read information it should not be able to access. Given AV:L and UI:R, exploitation is confined to the device and depends on the user running the attacker's app; no public exploit was identified at time of analysis.