U30 Air
Monthly
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.