ZTE

Latest CVEs · RSS

• CVE-2026-108506 2026-10-10 · CVSS 5.5
  ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through
• CVE-2026-108505 2026-10-10 · CVSS 3.3
  ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related
• CVE-2026-108504 2026-10-10 · CVSS 5.5
  ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exp
• CVE-2026-108503 2026-10-10 · CVSS 3.3
  ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker ca
• CVE-2026-108502 2026-10-10 · CVSS 3.3
  ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
• CVE-2026-108501 2026-10-10 · CVSS 5.7
  ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by refle
• CVE-2026-86556 2026-09-30 · CVSS 5.3
  There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant
• CVE-2026-86555 2026-09-20 · CVSS 6.2
  The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtain
• CVE-2026-86554 2026-09-20 · CVSS 4.3
  SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife applicatio
• CVE-2026-86553 2026-09-20 · CVSS 8.8
  SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application a
• CVE-2026-86552 2026-09-20 · CVSS 5.4
  SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication
• CVE-2026-86551 2026-09-20 · CVSS 3.3
  The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_
• CVE-2026-86550 2026-09-08 · CVSS 6.5
  NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects
• CVE-2026-49003 2026-08-31 · CVSS 9.6
  Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simult
• CVE-2026-9668 2026-08-26 · CVSS 6.3
  With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries
• CVE-2026-49008 2026-08-07 · CVSS 6.5
  By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application
• CVE-2026-49007 2026-08-07 · CVSS 7.5
  By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.
• CVE-2026-49006 2026-08-07 · CVSS 5.3
  By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.
• CVE-2026-49005 2026-08-07 · CVSS 2.4
  The root password hash of the device can be obtained through unencrypted information in the firmware.
• CVE-2026-8029 2026-08-05 · CVSS 3.9
  The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.
• CVE-2026-49004 2026-08-05 · CVSS 6.5
  The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specif
• CVE-2026-40000 2026-07-27 · CVSS 1.8
  The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can
• CVE-2026-49002 2026-05-27 · CVSS 9.1
  Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond th
• CVE-2026-49001 2026-05-27 · CVSS 5.3
  Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution
• CVE-2026-49000 2026-05-27 · CVSS 7.0
  An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implem