ZTE has 14 CVEs on record. Disclosure cadence is accelerating: 13 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 7. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-269 (10). Most affected products: Z80 Ultra (5), SmartLife (4), NX741J (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 13 prev 0
Weakness classes
Products
- Z80 Ultra 5
- SmartLife 4
- NX741J 1
- NebulaOS 1
- U30 Air 1
- ZTE Z80 Ultra 1
Worst active — by depth score
CVE-2026-86553High· 8.8SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process49CVE-2026-86552Medium· 5.4SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime42CVE-2026-86550Medium· 6.5NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects36CVE-2026-86555Medium· 6.2The ZTE SmartLife application has a hardcoded key34CVE-2026-108501Medium· 5.7ZTE Z80 Ultra has a system interface permission verification defect31
ZTE vulnerabilities
CVEs affecting ZTE, newest first. Open any entry for full detail, references, and exploit status.
14 CVEsRSS
CVE-2026-108506Medium· 5.5ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control
ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information.
CVE-2026-108505Low· 3.3ZTE Z80 Ultra has a local information disclosure vulnerability
ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.
CVE-2026-108504Medium· 5.5ZTE Z80 Ultra has an unauthorized information disclosure vulnerability
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.
CVE-2026-108503Low· 3.3ZTE Z80 Ultra has an interface permission validation vulnerability
ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.
CVE-2026-108502Low· 3.3ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
CVE-2026-108501Medium· 5.7ZTE Z80 Ultra has a system interface permission verification defect
ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.
CVE-2026-86556Medium· 5.3There is an information disclosure vulnerability in ZTE U30 Air
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information.
CVE-2026-86555Medium· 6.2The ZTE SmartLife application has a hardcoded key
The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.
CVE-2026-86554Medium· 4.3SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interf…
CVE-2026-86553High· 8.8SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface…
CVE-2026-86552Medium· 5.4PoCSmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitr…
CVE-2026-86551Low· 3.3The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.
The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.
CVE-2026-86550Medium· 6.5NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects
NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that …
CVE-2026-40002Medium· 5.0Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations
Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerability stems from the lack of validation for applications accessing the service interface. Exploiting …