CVE-2026-108504
MediumCVSS 5.5Summary
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. Access control for methods within the framework is insufficient, allowing an attacker to read device-related information.
Risk Assessment
An attacker can access sensitive device information, which may facilitate further attacks or expose sensitive data. This can lead to privacy breaches or network security compromise.
Recommendation
Apply available software updates addressing this vulnerability or contact ZTE for mitigation guidance. Consider restricting network access to the device.
Other vulnerabilities in ZTE Z80 Ultra
See all- CVE-2026-108506Medium
ZTE Z80 Ultra's system interfaces lack robust invocation authentication and have inadequate access control. Third-party apps may call these interfaces through reflection and retrieve relevant information.
- CVE-2026-108505Low
ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.
- CVE-2026-108503Low
ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.
- CVE-2026-108502Low
ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
- CVE-2026-108501Medium
The ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.
Original NVD description (English source)
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS