CVE-2026-108501: CWE-269: Improper Privilege Management in ZTE ZTE Z80 Ultra

The ZTE Z80 Ultra contains a system interface permission verification defect classified as CWE-269 (Improper Privilege Management). The affected interface does not enforce adequate access control, enabling an attacker to reflectively invoke the interface and read sensitive information. The CVSS 3.1 base score is 5.7, with attack vector as adjacent network, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No affected versions or patch information are provided, and no known exploits are reported in the wild.

An attacker with adjacent network access and the ability to induce user interaction can read sensitive information from the system interface due to missing permission checks. This compromises confidentiality but does not affect integrity or availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's interfaces to trusted users and networks to reduce exposure. Monitor for vendor updates regarding official fixes.