EUVD-2026-96294
GHSA-pv9h-j29r-q9hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitUser launches/grants app
-
ExecutionInvoke under-protected framework method
-
ImpactRead restricted device information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a locally installed, attacker-controlled application on the ZTE Z80 Ultra that calls framework methods whose access control is insufficient; the device description specifies 'methods within the framework,' and the CVSS UI:R indicates the user must install and/or interact with that app. Exploitation is LIMITED by: local access only (AV:L, no remote/network path), required user interaction (UI:R, e.g. installing the malicious app), and applicability only to the ZTE Z80 Ultra; impact is confined to reading device information (C:H, I:N, A:N) with no modification or privilege gain despite the 'Privilege Escalation' tag. |
| Impact | This is a moderate, locally-scoped issue rather than a top-tier priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) indicates exploitation is LOCAL - not remote/network - and requires user interaction, with impact limited to confidentiality (device information disclosure) and no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active exploitation or weaponization; the realistic risk is a malicious or privacy-abusing local app harvesting device information, not mass remote compromise. Note a tension to verify: PR:N (no privileges) combined with AV:L and UI:R implies an attacker-controlled local app that the user must interact with, which is a meaningfully higher bar than the raw 'Medium' label suggests. The 'Privilege Escalation' tag also overstates impact - CWE-269 here manifests as read-only information disclosure (I:N/A:N), not privilege gain - so treat this as an information-leak issue, not an escalation. |
| Exploit ScenarioDerived | A user installs a malicious or over-privileged application on a ZTE Z80 Ultra device. Because framework methods lack sufficient access control, the app invokes those methods and reads device-related information it should not be able to access. No public exploit code was identified, and exploitation is local with required user interaction (installing/running the app). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Information disclosure in ZTE Z80 Ultra allows a locally installed application to read device-related information by invoking framework methods that have insufficient access control. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) means an attacker needs local access and must persuade or trick the user into installing or interacting with a malicious app, with impact limited to confidentiality; there is no integrity or availability impact and no privilege gain, despite the 'Privilege Escalation' tag. No public exploit code is identified at time of analysis, and the issue is assessed as moderate and locally scoped.
RemediationAI
Apply the latest firmware or software update for ZTE Z80 Ultra as directed by the vendor advisory at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7927166620923281234; the provided data does not specify an exact fixed version, so the advisory should be checked for the patched build and installation instructions. Because exploitation requires a locally installed, attacker-controlled application and user interaction (UI:R), compensating controls should focus on reducing the chance of malicious app installation: avoid sideloading untrusted apps, review app permissions before granting device-information access, and for managed fleets use MDM or device policy to restrict app installation to approved sources. These mitigations reduce exposure but do not remove the underlying framework access-control weakness and may reduce user flexibility; no server-side workaround or network block is applicable because the vector is local-only (AV:L).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ZTE Z80 Ultra exposes framework methods whose access-control checks are insufficient (CWE-269, Improper Privilege Management), allowing an application with local execution on the device to query or read device-related information that should be restricted. The CPE cpe:2.3:a:zte:z80_ultra:*:*:*:*:*:*:*:* points to the ZTE Z80 Ultra product line as the affected platform; the wildcard version means the provided data does not narrow the affected firmware range, so the vendor bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7927166620923281234 should be treated as the authoritative version list. The CVSS vector's AV:L and UI:R reflect that this is not a network-reachable vulnerability: the attacker must already have a local application on the device and the user must interact with it, while PR:N shows the vulnerable method does not require prior privileges. The C:H/I:N/A:N impact indicates the primary consequence is reading sensitive device information, not altering data or disrupting availability.
Know when Z80 Ultra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploited by a local app without prior privileges (AV:L, PR:N) but needing user install/interaction (UI:R); read-only device-info leak means C:H, I:N, A:N.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
DescriptionCVE.org
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to inv
Information disclosure in ZTE Z80 Ultra devices lets a locally installed malicious application read information through
ZTE Z80 Ultra allows a malicious third-party application installed on the device to hook exposed system APIs and read li
Local information disclosure in ZTE Z80 Ultra devices allows an installed third-party application to capture device-rela
Exploit-DB