CVE-2026-108503CWE-276

CVE-2026-108503

Low · published October 10, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00129 · 2.3th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-10-10T11:16Z
References (1)
https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7927166620923281226 · [email protected]
EPSS history
Timeline
  • 11 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 10 OCT 06:52Z
    Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product
    cvelistv5
  • 10 OCT 06:52Z
    Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product
    cvelistv5