Z80 Ultra
Monthly
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to invoke system interfaces through reflection and retrieve sensitive information, because those interfaces lack robust invocation authentication and access control. Exploitation is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), with confidentiality impact only and no integrity or availability effect. No public exploit identified at time of analysis; the issue is classified under CWE-269 and tagged as privilege escalation, but the assessed impact is a moderate, local-only information-disclosure flaw rather than a high-priority remote threat.
Local information disclosure in ZTE Z80 Ultra devices allows an installed third-party application to capture device-related data returned by system interfaces that do not adequately restrict access. The issue requires local execution and user interaction to install or run the hostile app, and it needs no elevated privileges (PR:N), resulting in a low CVSS score of 3.3 with only confidentiality impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is best treated as low priority.
Information disclosure in ZTE Z80 Ultra allows a locally installed application to read device-related information by invoking framework methods that have insufficient access control. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) means an attacker needs local access and must persuade or trick the user into installing or interacting with a malicious app, with impact limited to confidentiality; there is no integrity or availability impact and no privilege gain, despite the 'Privilege Escalation' tag. No public exploit code is identified at time of analysis, and the issue is assessed as moderate and locally scoped.
Information disclosure in ZTE Z80 Ultra devices lets a locally installed malicious application read information through system callable functions that lack sufficient access control. This is a low-severity, low-priority local issue (CVSS 3.3) requiring user interaction, typically installing or launching the attacker's app, with only confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis.
ZTE Z80 Ultra allows a malicious third-party application installed on the device to hook exposed system APIs and read limited sensitive information, resulting in a low-severity information disclosure (CVSS 3.1 base score 3.3). The attack is local-only, requires user interaction to install the attacking app, and requires no special privileges (PR:N), with only a low confidentiality impact and no integrity or availability impact; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to invoke system interfaces through reflection and retrieve sensitive information, because those interfaces lack robust invocation authentication and access control. Exploitation is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), with confidentiality impact only and no integrity or availability effect. No public exploit identified at time of analysis; the issue is classified under CWE-269 and tagged as privilege escalation, but the assessed impact is a moderate, local-only information-disclosure flaw rather than a high-priority remote threat.
Local information disclosure in ZTE Z80 Ultra devices allows an installed third-party application to capture device-related data returned by system interfaces that do not adequately restrict access. The issue requires local execution and user interaction to install or run the hostile app, and it needs no elevated privileges (PR:N), resulting in a low CVSS score of 3.3 with only confidentiality impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is best treated as low priority.
Information disclosure in ZTE Z80 Ultra allows a locally installed application to read device-related information by invoking framework methods that have insufficient access control. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) means an attacker needs local access and must persuade or trick the user into installing or interacting with a malicious app, with impact limited to confidentiality; there is no integrity or availability impact and no privilege gain, despite the 'Privilege Escalation' tag. No public exploit code is identified at time of analysis, and the issue is assessed as moderate and locally scoped.
Information disclosure in ZTE Z80 Ultra devices lets a locally installed malicious application read information through system callable functions that lack sufficient access control. This is a low-severity, low-priority local issue (CVSS 3.3) requiring user interaction, typically installing or launching the attacker's app, with only confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis.
ZTE Z80 Ultra allows a malicious third-party application installed on the device to hook exposed system APIs and read limited sensitive information, resulting in a low-severity information disclosure (CVSS 3.1 base score 3.3). The attack is local-only, requires user interaction to install the attacking app, and requires no special privileges (PR:N), with only a low confidentiality impact and no integrity or availability impact; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).