EUVD-2026-96303
GHSA-f7mj-qxpc-pc3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
ExploitApp invokes system interface via reflection
-
ExecutionBypass weak access control
-
ImpactRetrieve sensitive system information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised third-party application to be installed and executed locally on a ZTE Z80 Ultra device (satisfying AV:L and UI:R); that app must use reflection to call system interfaces that do not enforce robust invocation authentication or access control. Limiting factors: exploitation is purely local - there is no remote/network vector, the attacker must first get an app onto the device (social engineering or sideloading), and impact is confined to reading information (C:H) with no integrity or availability effect. Default-configuration devices are affected since the weakness is in the system interfaces' access control itself, not an optional setting. |
| Impact | This is a moderate, local-only information-disclosure flaw rather than a high-priority remote threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) is internally consistent with the description: exploitation requires a malicious third-party app already running on the device (hence AV:L and UI:R, the user must install/run it) that abuses reflection to invoke under-protected system interfaces, yielding high confidentiality impact (C:H) with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The 'Privilege Escalation' tag and CWE-269 (Improper Privilege Management) frame this as a trust-boundary/access-control weakness, but the actual impact per the vector is information retrieval, not full privilege escalation - a mild signal conflict worth noting. Overall this is a genuine but lower-tier mobile-security issue: real for ZTE Z80 Ultra users exposed to malicious apps, but not an urgent fleet-wide emergency. |
| Exploit ScenarioDerived | A user is tricked into installing a seemingly benign third-party Android app on a ZTE Z80 Ultra. Once running locally, the app uses Java reflection to invoke system interfaces that lack adequate invocation authentication and access control, allowing it to read sensitive device/system information it should not have access to. No public exploit code was provided, and the attack is confined to the device where the malicious app runs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to invoke system interfaces through reflection and retrieve sensitive information, because those interfaces lack robust invocation authentication and access control. Exploitation is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), with confidentiality impact only and no integrity or availability effect. No public exploit identified at time of analysis; the issue is classified under CWE-269 and tagged as privilege escalation, but the assessed impact is a moderate, local-only information-disclosure flaw rather than a high-priority remote threat.
RemediationAI
No vendor-released patch is identified in the provided data at time of analysis. Affected users and administrators should monitor the ZTE advisory at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7927166620923281253 for a firmware or security update and apply the latest ZTE-provided build as soon as it is available, because no exact fix version is given. Because exploitation requires a malicious or compromised third-party app to be installed and user interaction, the most direct compensating controls are to disable sideloading and unknown-source installation, restrict apps to trusted vendor or enterprise app stores, and use mobile device management allowlisting to prevent untrusted applications from running; the trade-off is reduced flexibility for users and developers who rely on sideloaded or internal apps. Enterprises should also review installed third-party apps and remove any that are untrusted or that abuse reflection, though this is reactive and may not prevent a future malicious app from exploiting the same interfaces. Network-level blocking is not an effective mitigation because the CVSS vector is local.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in improper privilege management (CWE-269) within ZTE Z80 Ultra system interfaces, which do not adequately authenticate interface invocations or enforce caller access controls. A third-party application can use reflection to access internal or system-level APIs that should not be reachable by ordinary apps, then extract information exposed by those interfaces. The CPE string cpe:2.3:a:zte:z80_ultra:*:*:*:*:*:*:*:* indicates that the base product identifier is affected across versions, and the CVSS vector confirms a local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), high confidentiality impact (C:H), and no integrity (I:N) or availability (A:N) impact. This means the attacker must already have a malicious or compromised app installed and must rely on the user to trigger the vulnerable behavior, but the flaw is in the system interfaces' access control itself, so default configurations are affected.
Know when Z80 Ultra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local because a resident app is required (AV:L), UI:R for installing/running that app, PR:N as no prior privileges are needed, and confidentiality-only impact (C:H, I/A:N) per the information-retrieval description.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
DescriptionCVE.org
ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure in ZTE Z80 Ultra allows a locally installed application to read device-related information by inv
Information disclosure in ZTE Z80 Ultra devices lets a locally installed malicious application read information through
ZTE Z80 Ultra allows a malicious third-party application installed on the device to hook exposed system APIs and read li
Local information disclosure in ZTE Z80 Ultra devices allows an installed third-party application to capture device-rela
Exploit-DB