EUVD-2026-89572
GHSA-jwp9-788m-pwx7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed U30 Air interface
-
ExploitSend request lacking permission check
-
ExecutionDevice returns restricted information
-
ImpactHarvest disclosed data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the vulnerable service on a ZTE U30 Air device; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed, implying default-configuration exposure of the affected interface. The primary limiting factors are: the impact ceiling is low confidentiality only (no integrity/availability effect, so no takeover), the affected component/interface must be network-exposed (which for a consumer/CPE router may be LAN-side or WAN-side depending on deployment - not specified in the description), and the specific information disclosed is undefined by the vendor. The device's niche deployment further limits realistic attack surface. |
| Impact | This is a moderate, real-but-not-urgent issue. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) describes a remotely reachable, unauthenticated, low-complexity flaw whose impact is limited strictly to low confidentiality - no integrity or availability effect. This ceiling is the dominant signal: even with easy remote access, the attacker only obtains 'relevant information,' not code execution or takeover. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no evidence of exploitation or automation. Note a tension between the CWE and the tags: CWE-269 (Improper Privilege Management) and the 'Privilege Escalation' tag imply escalation, yet the CVSS vector shows only C:L with I:N/A:N, meaning the concrete outcome is information disclosure rather than privilege gain - the tag overstates impact. The vendor description is extremely sparse ('obtain relevant information'), so the exact data exposed and the affected component cannot be verified from available data; this should be confirmed against the ZTE bulletin. Overall: a genuine unauthenticated remote info-leak worth patching on affected devices, but low priority relative to RCE-class or actively-exploited issues. |
| Exploit ScenarioDerived | A remote attacker who can reach the ZTE U30 Air's network-exposed management or service interface sends a request that the device fails to properly permission-check, causing it to return information the attacker should not be able to read. No authentication or user interaction is required per the CVSS vector. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.
RemediationAI
No vendor-released patch version is identified in the available data; the primary action is to check the ZTE security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3351503523831148854 and apply the firmware update ZTE publishes for the U30 Air, following the vendor's upgrade instructions to preserve device configuration. Until an update can be applied, reduce exposure of the vulnerable interface: block inbound access to the device's management/web interface from untrusted networks at the perimeter firewall, avoid WAN-side exposure of device administration (disable remote management if the firmware exposes such an option - the trade-off is loss of remote troubleshooting), and place the device behind NAT or a filtering gateway so only the required internal clients can reach it. On the LAN side, restrict the affected service to specific management hosts via ACLs or VLAN segmentation, noting that this complicates legitimate administration from general user subnets. Because the required privileges are nominally unauthenticated per the assessed vector, credential hardening alone will not close the issue, and there is no indication that changing default passwords mitigates it. Monitor device and perimeter logs for unexpected access to administrative endpoints as a detection measure rather than a fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-86556 is classified under CWE-269 (Improper Privilege Management), which is the root-cause class: the product fails to correctly assign or enforce permission levels for access to a resource, so a request that should be rejected or restricted is instead served. In this case the misapplied permissions result in disclosure of information rather than code execution. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the vulnerable component is reached over the network with no credential requirement and no victim interaction, implying the affected interface is reachable in a default configuration; the scope is Unchanged and only Confidentiality is impacted at Low level, so the leaked data is bounded and the same flaw does not escalate to integrity or availability loss. The affected product is captured by the CPE cpe:2.3:a:zte:u30_air:*:*:*:*:*:*:*:*, indicating the ZTE U30 Air line as a whole without a version qualifier, so the vulnerable service should be assumed present across firmware revisions until the vendor bulletin identifies otherwise. Whether the affected interface is exposed LAN-side or WAN-side is not specified in the available description, which materially affects how easily an external attacker could reach it. The tags accompanying this CVE ('Privilege Escalation', 'Information Disclosure') reflect the reporter's framing of improper permission handling, but the assessed impact remains information disclosure with a low confidentiality-only ceiling.
Know when U30 Air gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vendor states unauthenticated remote access with easy exploitation and information disclosure only, so PR:N/AC:L/AV:N with C:L and I:N/A:N; I concur with the vendor vector.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
DescriptionCVE.org
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB