CVE-2026-108504

Received Received - Intake

Unauthorized Information Disclosure in ZTE Z80 Ultra

Publication date: 2026-10-10

Last updated on: 2026-10-11

Assigner: ZTE Corporation

Description

ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-11

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108504

EUVD

EUVD-2026-96294

Affected Vendors & Products

Vendor	Product	Version / Range
ZTE	Z80	Ultra GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in ZTE Z80 Ultra allows unauthorized access to device-related information due to insufficient access control in framework methods. An attacker can exploit this to read sensitive data without proper authorization.

Impact Analysis

An attacker could access sensitive device information, potentially leading to privacy breaches or further exploitation of the device. This may compromise user data or device integrity if exploited.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating privacy requirements in GDPR and HIPAA. Organizations may face compliance penalties if such breaches occur due to insufficient access controls.

Mitigation Strategies

Apply the latest security patches or firmware updates from ZTE to address the insufficient access control in the framework. Disable unnecessary services or methods that could expose device information. Monitor network traffic for unusual access attempts to sensitive device data.

Hi! I’m here to help you understand CVE-2026-108504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70