Nx741J
Monthly
Non-privileged applications running on a ZTE nubia Z80 Ultra (NX741J) smartphone can retrieve the device's Wi-Fi MAC address by querying the read-only factory_mac_address field exposed through the Android Settings.Secure content database, defeating the platform's normal restriction on hardware MAC address access. The issue is purely local (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N, base score 3.3, C:L/I:N/A:N), requires an attacker-supplied app to already be installed and executing on the handset, and leaks only a single low-sensitivity hardware identifier whose main value is device tracking rather than data compromise. According to available intelligence, no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; deployment is limited to a single consumer handset model, which keeps overall risk low.
Non-privileged applications running on a ZTE nubia Z80 Ultra (NX741J) smartphone can retrieve the device's Wi-Fi MAC address by querying the read-only factory_mac_address field exposed through the Android Settings.Secure content database, defeating the platform's normal restriction on hardware MAC address access. The issue is purely local (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N, base score 3.3, C:L/I:N/A:N), requires an attacker-supplied app to already be installed and executing on the handset, and leaks only a single low-sensitivity hardware identifier whose main value is device tracking rather than data compromise. According to available intelligence, no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; deployment is limited to a single consumer handset model, which keeps overall risk low.