EUVD-2026-96228
GHSA-7xw7-52f6-f4qf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing app
-
ExploitApp hooks system APIs
-
ExecutionRead restricted system information
-
ImpactExfiltrate disclosed data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a malicious or over-reaching THIRD-PARTY APPLICATION to be installed on the ZTE Z80 Ultra device, which then hooks exposed system APIs to read information. The limiting factors are significant: the attack is local-only (AV:L) with no network path, the user must install the attacker's app (UI:R), and the disclosed data is limited (C:L) with no integrity or availability impact. There is no indication the flaw is reachable remotely or exploitable against a default, un-tampered device without first achieving app installation. |
| Impact | This is a low-severity, low-priority issue rather than a high-CVSS alarm - the provided CVSS 3.1 base score is only 3.3, and all signals point the same direction with no conflict. The vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is LOCAL, not network-reachable: a malicious third-party application must already be installed on the ZTE Z80 Ultra handset, and the impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability effect. No EPSS probability is supplied, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of exploitation pressure. The CWE-269 (improper privilege management) classification is consistent with a rogue app hooking system APIs to read data it should not reach. The only mild tension is that the Tags include 'Privilege Escalation' while the described and scored impact is purely information disclosure with no privilege gain (I:N, S:U) - treat the escalation framing with caution and verify against the ZTE bulletin. Overall: a genuine but minor on-device privacy flaw, not an urgent remote threat. |
| Exploit ScenarioDerived | A user installs a malicious or over-privileged third-party app on a ZTE Z80 Ultra; the app hooks exposed system APIs and reads information it should not be able to access, leaking it off-device. No public exploit code is referenced, and exploitation requires the victim to install the attacker's app (UI:R), so impact is confined to the compromised handset. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
ZTE Z80 Ultra allows a malicious third-party application installed on the device to hook exposed system APIs and read limited sensitive information, resulting in a low-severity information disclosure (CVSS 3.1 base score 3.3). The attack is local-only, requires user interaction to install the attacking app, and requires no special privileges (PR:N), with only a low confidentiality impact and no integrity or availability impact; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
RemediationAI
No vendor-released patch is identified in the provided data; consult the ZTE advisory at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1450988451697172610 for updates and apply any patch as soon as it becomes available. As a compensating control, users should restrict app installation to trusted sources such as official app stores and avoid sideloading untrusted applications, since the attack requires a malicious app to be installed. Disabling developer options and USB debugging when not needed can reduce the risk of API hooking frameworks, though this may impact development or advanced use cases. Enterprise administrators can enforce app allowlisting via MDM to prevent installation of unauthorized applications. Monitor the vendor advisory for future security updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-269 (Improper Privilege Management), meaning the ZTE Z80 Ultra's system fails to properly restrict or isolate access to its exposed APIs, allowing a third-party application to intercept or hook those APIs and read information it should not have access to. API hooking typically involves intercepting function calls at runtime, and on this mobile device platform, the flaw permits such hooking without sufficient privilege checks. The affected component is the Z80 Ultra device itself (CPE: cpe:2.3:a:zte:z80_ultra:*:*:*:*:*:*:*:*), and the attack vector is local (AV:L) with user interaction (UI:R) required to install the malicious app. The low confidentiality impact (C:L) reflects that the exposed information is limited, and there is no impact to integrity or availability. No specific system API or library is named in the advisory.
Know when Z80 Ultra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Local vector because a resident app is required (AV:L); the app needs no special privileges (PR:N) but relies on user installation (UI:R); impact is limited confidentiality only (C:L, I:N, A:N).
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
DescriptionCVE.org
ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to inv
Information disclosure in ZTE Z80 Ultra allows a locally installed application to read device-related information by inv
Information disclosure in ZTE Z80 Ultra devices lets a locally installed malicious application read information through
Local information disclosure in ZTE Z80 Ultra devices allows an installed third-party application to capture device-rela
Exploit-DB