EUVD-2026-96302
GHSA-84p9-8cvg-cjg4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
ExploitApp runs locally in own sandbox
-
ExecutionQuery under-protected system interfaces
-
ImpactCapture returned device information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a malicious or untrusted third-party application to already be installed and running on the ZTE Z80 Ultra device; the app then reads data returned by system interfaces that fail to adequately restrict access. Limiting factors: the attack is strictly local (AV:L) with no remote path, it depends on user interaction (UI:R) to install/run the hostile app, it requires no elevated privileges (PR:N) beyond normal app execution, and the leak is confined to this specific device model. Impact is limited to confidentiality of device-related information, with no integrity or availability effect. |
| Impact | This is a genuinely low-priority issue, and the available signals are consistent rather than conflicting. The vendor-supplied CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.3) describes a local attack vector requiring on-device code execution by a malicious third-party application, low complexity, no privileges, but user interaction (the victim must install/run the offending app). Impact is limited to low confidentiality with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is no SSVC decision data supplied. The one nuance worth flagging: PR:N combined with UI:R together imply the real precondition is that the user sideloads or runs a hostile app - the attacker needs no account privileges, but does need their code running in a separate app sandbox on the device. This is a low-CVSS and low-real-risk issue: a local, info-only leak on a single specific smartphone model, not a remotely exploitable or wormable flaw. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app from outside the trusted store onto a ZTE Z80 Ultra. Once running in its own sandbox, the app queries exposed system interfaces that insufficiently restrict access and harvests device-related information (e.g., identifiers or configuration data) it should not be able to read. No public exploit code was identified; exploitation requires only local app execution and low attack complexity per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Local information disclosure in ZTE Z80 Ultra devices allows an installed third-party application to capture device-related data returned by system interfaces that do not adequately restrict access. The issue requires local execution and user interaction to install or run the hostile app, and it needs no elevated privileges (PR:N), resulting in a low CVSS score of 3.3 with only confidentiality impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is best treated as low priority.
RemediationAI
No vendor-released patch identified at time of analysis; ZTE's support bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982103317 should be checked for an updated firmware or vendor remediation. Until a fixed build is confirmed, restrict exposure by avoiding installation of untrusted or sideloaded third-party applications on affected Z80 Ultra devices, reviewing app permissions to limit access to system-interface data where the platform permits, and monitoring for unexpected app behavior. These controls reduce the attack surface but may restrict legitimate app functionality; because exploitation requires local installation and user interaction, cautious app sourcing and permission management are the most direct compensating measures.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is assigned CWE-269 (Improper Privilege Management), which indicates that system interfaces on the ZTE Z80 Ultra fail to enforce appropriate access boundaries for data they return. A malicious or untrusted third-party app running on the device can read that returned data, leading to local information disclosure about the device. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N confirms the attack is local, requires user interaction (for example, installing or launching the app), needs no elevated privileges, and affects only confidentiality with low impact; there is no integrity or availability impact. The CPE cpe:2.3:a:zte:z80_ultra:*:*:*:*:*:*:*:* applies to the ZTE Z80 Ultra product line broadly, and the accompanying tags mention Privilege Escalation and Information Disclosure, though the assessed impact is limited to information disclosure and improper privilege management rather than a full privilege escalation.
Know when Z80 Ultra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Local because a resident third-party app is required (AV:L); UI:R as the user must install/run that app; PR:N since no device privileges are needed; only low confidentiality impact.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
DescriptionCVE.org
ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to inv
Information disclosure in ZTE Z80 Ultra allows a locally installed application to read device-related information by inv
Information disclosure in ZTE Z80 Ultra devices lets a locally installed malicious application read information through
ZTE Z80 Ultra allows a malicious third-party application installed on the device to hook exposed system APIs and read li
Exploit-DB