CVE-2026-86551: Z80Ultra Information Disclosure Vulnerability

CVE-2026-86551 Overview

CVE-2026-86551 is an information disclosure vulnerability in the ZTE Z80Ultra (NX741J) mobile device. Non-privileged applications can read the Wi-Fi Media Access Control (MAC) address by querying the read-only factory_mac_address field in the Settings.Secure database. Android normally restricts access to hardware identifiers such as the Wi-Fi MAC address to protect user privacy and prevent device tracking. This vendor-specific field bypasses that protection and exposes the identifier to any local application without requiring elevated permissions. The weakness is categorized as [CWE-668] Exposure of Resource to Wrong Sphere.

Critical Impact
Any locally installed application can retrieve a persistent hardware identifier without user consent, enabling cross-application user tracking and device fingerprinting.

Affected Products

ZTE Z80Ultra (model NX741J)
Vendor-customized Settings.Secure provider exposing factory_mac_address
Refer to the ZTE Support Bulletin for the authoritative fixed-version list

Discovery Timeline

2026-09-20 - CVE-2026-86551 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-86551

Vulnerability Analysis

Android classifies the Wi-Fi MAC address as a hardware identifier. Since Android 6.0, apps must hold the LOCAL_MAC_ADDRESS privileged permission or ACCESS_FINE_LOCATION to obtain it through the standard WifiManager APIs. On the ZTE Z80Ultra, the vendor persists the factory-provisioned MAC address in the Settings.Secure content provider under the key factory_mac_address. Values in Settings.Secure are world-readable to any application that can query the provider. The vendor customization removes the permission barrier that Android enforces on the standard APIs.

A local attacker with any installed unprivileged app can read this value and correlate the device across app installs, factory resets of user data, and network changes. The MAC address does not rotate, so it acts as a persistent tracking identifier.

Root Cause

The root cause is improper resource exposure between security spheres [CWE-668]. The vendor stored a sensitive hardware identifier in a shared configuration store that lacks per-key permission enforcement. The read-only nature of the field prevents modification but does not restrict read access, which is the security boundary Android enforces on hardware identifiers.

Attack Vector

Exploitation requires local access through an installed application. No special permissions are needed and no user interaction beyond app installation is required. A malicious or overly curious app queries the Settings.Secure provider for the factory_mac_address key using the standard Settings.Secure.getString(ContentResolver, String) API and receives the Wi-Fi MAC address as a string. The retrieved value can then be transmitted off-device or used as a stable device fingerprint.

No public proof-of-concept is listed in the NVD entry, and the EPSS data indicates a low predicted exploitation probability.

Detection Methods for CVE-2026-86551

Indicators of Compromise

Application logs or network telemetry showing outbound transmission of a string matching the device Wi-Fi MAC address format (XX:XX:XX:XX:XX:XX).
Unexpected reads against the Settings.Secure provider from unprivileged third-party apps.
Presence of the literal key name factory_mac_address in application binaries or decompiled code.

Detection Strategies

Perform static analysis of installed APKs for references to Settings.Secure.getString calls paired with the factory_mac_address constant.
Use mobile application vetting tools to flag apps that query non-standard Settings.Secure keys reserved for vendor use.
Monitor Mobile Device Management (MDM) inventory for the affected NX741J model and prioritize those devices for policy review.

Monitoring Recommendations

Enable enterprise mobile threat defense telemetry on ZTE Z80Ultra devices to capture application behavior related to device identifier access.
Review network egress logs from managed mobile devices for hardware identifiers appearing in outbound analytics or advertising traffic.
Track vendor advisories from ZTE for a firmware release that removes or restricts the factory_mac_address field.

How to Mitigate CVE-2026-86551

Immediate Actions Required

Inventory devices to identify any ZTE Z80Ultra (NX741J) units in the environment.
Restrict installation of untrusted applications on affected devices through MDM application allowlisting.
Apply the vendor firmware update once published by ZTE in the referenced support bulletin.

Patch Information

ZTE published a support bulletin acknowledging the issue. Consult the ZTE Support Bulletin for the authoritative fixed firmware version and rollout guidance. Deploy the vendor firmware through the standard over-the-air update channel or MDM push once available for the NX741J model.

Workarounds

Limit exposure by installing only vetted applications from trusted publishers on affected devices.
Use enterprise MDM policies to block or uninstall applications that request excessive access to device identifiers.
Segment ZTE Z80Ultra devices onto dedicated network segments where MAC-based tracking has reduced business impact until firmware is updated.

bash

# Example: query MDM inventory for affected model (illustrative)
mdm-cli devices list --filter "model=NX741J" --output json