Vulnerabilities

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control.

ZTE Z80 Ultra has a local information disclosure vulnerability.

ZTE Z80 Ultra has an unauthorized information disclosure vulnerability.

ZTE Z80 Ultra has an interface permission validation vulnerability.

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.

ZTE Z80 Ultra has a system interface permission verification defect.

There is an information disclosure vulnerability in ZTE U30 Air.

The ZTE SmartLife application has a hardcoded key.

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process.

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process.

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime.

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects.

Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configura…

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly.

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.

The root password hash of the device can be obtained through unencrypted information in the firmware.

The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone nu…

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities.

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files.

Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration…

Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution of unintended operations such as tampering with configurati…