ZTE Smart Life CVE-2026-8029

Physical possession of the target mobile device running the ZTE Smart Life app is the primary hard prerequisite - remote or network-based exploitation is not possible per the AV:P CVSS metric. The attacker must also hold at least a low-privilege authenticated session within the app (PR:L), meaning they must be logged in or able to access the feedback functionality. User interaction is required (UI:R), suggesting the exploit is triggered through a specific in-app action such as submitting feedback. High attack complexity (AC:H) indicates that reliable injection may depend on specific app state, version, or input field conditions. Exploitation is limited to reading data from the local feedback.db SQLite database - there is no integrity impact (I:N) and no remote exfiltration path inherent to this vulnerability itself. The vulnerability does NOT affect users whose devices are secured with screen lock, encryption, or are not physically accessible to the attacker.

The composite risk profile here is notably low despite the C:H confidentiality impact. The CVSS base score of 3.9 accurately reflects the cumulative constraints: physical access (AV:P) eliminates all remote and adjacent-network attack scenarios; high complexity (AC:H) means reliable exploitation is non-trivial; low privileges (PR:L) requires the attacker to already have an authenticated app session; and user interaction (UI:R) adds a further dependency. EPSS data was not provided, but given AV:P and AC:H, the automated exploitation probability would be expected to be extremely low. The vulnerability is not listed in CISA KEV. No public proof-of-concept code was identified in the input data. In practice, the primary realistic threat actor is someone who has unlocked physical access to a victim's device - a domestic or workplace adversary scenario rather than a scalable internet-facing threat. The C:H signal is real for the narrow scenario where an attacker has the device in hand, but this is not a priority for enterprise patch programs unless ZTE Smart Life is managed on corporate device fleets with sensitive user profiles.

An attacker who has gained physical access to an unlocked mobile device - for example, a domestic partner, colleague, or device thief who bypasses the screen lock - opens the ZTE Smart Life app while authenticated as a low-privilege user. The attacker crafts a UNION SELECT payload injected into a user-controlled input field (such as the feedback submission form), causing the app's SQLite query to return rows from additional tables in feedback.db, exposing phone numbers, account identifiers, and debug log paths. No public proof-of-concept exploit was identified at time of analysis, but UNION-based SQLite injection is a well-understood technique that skilled attackers can implement manually.