CVE-2026-8029 is an SQL injection vulnerability in the ZTE Smart Life application. It permits attackers to inject UNION SELECT statements to retrieve sensitive information from the feedback.db database. The exposed data includes user account details, phone numbers, feedback contents, and local debug log paths, potentially leading to privacy data theft. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). No official patch or remediation level has been published by the vendor as of the current data.

Successful exploitation can lead to unauthorized disclosure of sensitive user data stored locally in the feedback.db database. The confidentiality of user accounts, phone numbers, feedback content, and debug log paths can be compromised. There is no indication of impact on integrity or availability. The CVSS score of 3.9 reflects a low severity with attack vector requiring physical proximity (AV:P), high attack complexity (AC:H), and low privileges (PR:L) with user interaction (UI:R) needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should limit access to the affected application and database files to trusted users only. Avoid using the vulnerable app in untrusted environments and monitor for updates from ZTE regarding patches or mitigations.