EUVD-2026-53292
GHSA-4pf2-5j8p-ghjv
Severity by source
AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Physical access required to reach the app's local SQLite DB; read-only UNION SELECT means no integrity or availability impact.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the theft of local privacy data.
AnalysisAI
SQL injection in the ZTE Smart Life mobile app enables a local attacker with physical device access to execute UNION SELECT statements against the app's feedback.db SQLite database, extracting sensitive personal data including user account details, phone numbers, feedback content, and local debug log paths. Exploitation is severely constrained by the CVSS:3.1/AV:P/AC:H/PR:L/UI:R vector, requiring physical access to the device, a low-privilege authenticated session within the app, user interaction, and non-trivial attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical possession of the target mobile device running the ZTE Smart Life app is the primary hard prerequisite - remote or network-based exploitation is not possible per the AV:P CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The composite risk profile here is notably low despite the C:H confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained physical access to an unlocked mobile device - for example, a domestic partner, colleague, or device thief who bypasses the screen lock - opens the ZTE Smart Life app while authenticated as a low-privilege user. The attacker crafts a UNION SELECT payload injected into a user-controlled input field (such as the feedback submission form), causing the app's SQLite query to return rows from additional tables in feedback.db, exposing phone numbers, account identifiers, and debug log paths. … |
| Remediation | The primary remediation is to apply the patch or upgraded version of the ZTE Smart Life app as identified in the ZTE PSIRT bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/874505866159001729. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, whic
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password ha
The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account
Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE
connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to mo
Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrato
All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control
The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which
Same weakness CWE-89 – SQL Injection
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today