CVE-2026-108505: ZTE Z80 Ultra Information Disclosure

CVE-2026-108505 Overview

CVE-2026-108505 is a local information disclosure vulnerability affecting the ZTE Z80 Ultra smartphone. Third-party applications installed on the device can capture data returned by system interfaces to obtain device-related information. The flaw is categorized under [CWE-269] Improper Privilege Management, indicating that system interfaces return data to callers that should not be granted access.

Exploitation requires local access and user interaction, such as installing and running a malicious application. The disclosed data is limited to device-related information rather than user credentials or content.

Critical Impact
A third-party application on an affected ZTE Z80 Ultra device can read device information exposed through system interfaces without appropriate privilege checks.

Affected Products

ZTE Z80 Ultra smartphone

Discovery Timeline

2026-10-10 - CVE-2026-108505 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108505

Vulnerability Analysis

The vulnerability resides in system-level interfaces exposed on the ZTE Z80 Ultra. These interfaces return device-related information to any caller without enforcing adequate privilege boundaries. A third-party application running under standard user permissions can query these interfaces and capture the returned data.

The attack is local, requires low complexity, and does not require prior privileges. User interaction is required, which typically means the victim installs or launches the attacker-controlled application. Confidentiality impact is limited to disclosed device metadata; integrity and availability are not affected.

The exposed data falls into the category of device-related information. This can include identifiers or configuration details that aid in device fingerprinting, targeted follow-on attacks, or tracking.

Root Cause

The root cause is improper privilege management [CWE-269] in system interfaces on the ZTE Z80 Ultra. The interfaces fail to verify whether the calling application holds the permission required to read the returned information. This gap allows unprivileged third-party applications to access data intended for privileged system components.

Attack Vector

An attacker publishes or sideloads a third-party application onto an affected device. Once the user runs the application, it invokes the vulnerable system interfaces and records the responses. See the ZTE Support Bulletin for vendor-provided technical details.

Detection Methods for CVE-2026-108505

Indicators of Compromise

Third-party applications requesting access to system interfaces that return device identifiers or configuration data.
Unexpected outbound network traffic from mobile applications containing device metadata.
Installation of applications from unofficial sources on ZTE Z80 Ultra devices.

Detection Strategies

Review installed applications on ZTE Z80 Ultra devices for unknown or unapproved packages.
Inspect mobile application behavior with runtime analysis tooling to identify calls to vulnerable system interfaces.
Correlate mobile device management (MDM) telemetry with application permission requests that target device information APIs.

Monitoring Recommendations

Enable MDM compliance checks that flag ZTE Z80 Ultra devices missing the vendor security update.
Monitor enterprise app catalogs for sideloaded or unsigned applications on managed ZTE devices.
Capture application network telemetry to detect exfiltration of device identifiers to external endpoints.

How to Mitigate CVE-2026-108505

Immediate Actions Required

Apply the firmware update referenced in the ZTE Support Bulletin as soon as it is available for your region.
Restrict installation of third-party applications on ZTE Z80 Ultra devices used in enterprise contexts.
Audit currently installed applications and remove any that are untrusted or unnecessary.

Patch Information

ZTE has published a support bulletin for CVE-2026-108505. Refer to the ZTE Support Bulletin for the fixed firmware version and deployment guidance for the Z80 Ultra.

Workarounds

Install applications only from the official vendor application store and verified publishers.
Enforce MDM policies that block sideloading and restrict unknown sources on managed devices.
Limit the use of ZTE Z80 Ultra devices for handling sensitive data until the vendor patch is applied.

bash

# Configuration example: enforce MDM policy to block unknown-source installs
# (Vendor-neutral guidance — adapt syntax to your MDM platform)
mdm policy set --device-model "ZTE Z80 Ultra" \
  --allow-unknown-sources false \
  --require-firmware-update true \
  --app-source "official-store-only"