Threat database

CVE-2026-108506 is a medium severity vulnerability in the ZTE Z80 Ultra device involving improper privilege management. The system interfaces lack robust authentication and have inadequate access control, allowing third-party applications to invoke these interfaces via reflection and potentially retrieve sensitive information. There is no indication of a patch or fix available at this time.

ZTE Z80 Ultra contains a local information disclosure vulnerability due to improper privilege management. This flaw allows third-party applications to capture data returned by system interfaces, potentially exposing device-related information. The vulnerability has a low severity rating and does not impact integrity or availability.

CVE-2026-108504 is an unauthorized information disclosure vulnerability in the ZTE Z80 Ultra device. The issue arises from insufficient access control on methods within the device's framework, allowing an attacker to read sensitive device-related information. The vulnerability has a medium severity with a CVSS score of 5.5. No specific affected versions or patches are currently documented.

ZTE Z80 Ultra contains an interface permission validation vulnerability (CWE-276) where system callable functions lack sufficient access control. This flaw allows an attacker to read certain information by leveraging these improperly protected functions. The vulnerability has a low severity rating with a CVSS score of 3.3. No specific affected versions or patches are currently identified.

ZTE Z80 Ultra has an information disclosure vulnerability due to improper privilege management. This flaw allows third-party applications to read sensitive information by hooking system APIs. The vulnerability has a low severity score and does not affect system integrity or availability.

CVE-2026-108501 is a medium severity vulnerability in the ZTE Z80 Ultra device involving improper privilege management. The system interface lacks necessary permission verification, allowing reflective invocation to read sensitive information without proper access control. This vulnerability does not impact integrity or availability but can lead to unauthorized disclosure of confidential data.

ZTE SmartLife application contains a hardcoded cryptographic key stored in plaintext within its code. This key is used to decrypt account server information. If an attacker obtains this key, they can decrypt sensitive server information, leading to exposure of confidential data. The vulnerability is identified as CWE-798 (Use of Hard-coded Credentials) and has a CVSS v3.1 score of 6.2, indicating a medium severity. No affected versions or patches have been explicitly stated.

CVE-2026-86554 is a medium severity vulnerability in the ZTE SmartLife application involving improper privilege management. The app dynamically generates authentication parameters during runtime, which attackers can obtain and use to query the backend interface /account/verify.serv. This allows attackers to verify if a target email address is registered with SmartLife and retrieve the corresponding backend account ID. There is no indication of a patch or fix available at this time.

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.

CVE-2026-49003 is a critical improper authentication vulnerability in ZTE ZXDU68 S202 V5.0. Attackers exploiting this flaw can perform command injection to delete core system runtime files, causing the monitoring module to crash. They can also gain root privileges to steal configuration passwords such as SNMP, tamper with critical system parameters, and disrupt the operation of the entire power system.

CVE-2026-9668 is an SQL injection vulnerability in ZTE SCP that allows attackers with legitimate user credentials to execute arbitrary database queries by crafting malicious SQL statements. This can bypass authentication logic, cause slow database queries, and expand query coverage. The vulnerability has a low exploitation threshold and does not require external privilege escalation. It is classified as a medium-severity issue with a CVSS score of 6.3.

CVE-2026-49008 is a medium severity vulnerability in the ZTE F689 device involving the use of a hard-coded cryptographic key. An attacker who accesses unencrypted firmware information can obtain credentials used for integrity verification of a specific application function on the device. This could allow unauthorized modification or tampering with that function. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-49007 is a high-severity vulnerability in the ZTE F689 device where unencrypted firmware information allows attackers to obtain initial login credentials for the device's web interface. This exposure can lead to unauthorized access with high confidentiality impact but no integrity or availability impact is indicated.

CVE-2026-49006 is a medium severity vulnerability in the ZTE F689 device involving the use of a hard-coded cryptographic key. An attacker who accesses unencrypted firmware information can obtain credentials related to TLS transmission. This vulnerability does not have a confirmed patch or official remediation guidance as of the publication date.

CVE-2026-49005 is a low-severity vulnerability in the ZTE F689 device where the root password hash can be extracted from unencrypted firmware data. The weakness involves the use of a password hash with insufficient computational effort, classified under CWE-916. This vulnerability does not have a known exploit in the wild and no official patch or remediation guidance has been provided by the vendor. The impact is limited to potential exposure of the root password hash, which could aid an attacker with physical or firmware access. No affected software versions are explicitly stated.

ZTE Smart Life app has an SQL injection vulnerability that allows attackers to execute UNION SELECT queries on the feedback.db database. This can expose sensitive data including user accounts, phone numbers, feedback content, and local debug log paths. The vulnerability has a low CVSS score of 3.9 and does not have a confirmed patch or remediation guidance yet.

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.