PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108503 ZTE CVE debrief

The ZTE Z80 Ultra product has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control, allowing an attacker to leverage these functions to read relevant information. This vulnerability affects the ZTE Z80 Ultra product, which is used for specific purposes. The lack of access control in the callable functions can lead to unauthorized information acquisition. The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability.

Vendor
ZTE
Product
Z80 Ultra
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-10
Original CVE updated
2026-10-10
Advisory published
2026-10-10
Advisory updated
2026-10-10

Who should care

Defenders responsible for ZTE Z80 Ultra product inventory and security should assess exposure and prioritize verification of inventory for ZTE Z80 Ultra product versions GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions. They should review and implement compensating controls for insufficient access control and verify inventory for potential vulnerability.

Why it matters

Defenders should assess exposure and prioritize verification of inventory for ZTE Z80 Ultra product versions GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions due to insufficient access control.

  • Read access to sensitive information may be possible due to insufficient access control
  • Verification of inventory for affected ZTE Z80 Ultra product versions is required

Technical summary

The ZTE Z80 Ultra product has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control, allowing an attacker to leverage these functions to read relevant information. This vulnerability affects the ZTE Z80 Ultra product, which is used for specific purposes. The lack of access control in the callable functions can lead to unauthorized information acquisition.

Defensive priority

Defenders should assess exposure and prioritize verification of inventory for ZTE Z80 Ultra product versions GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions.

Recommended defensive actions

  • Assess exposure of ZTE Z80 Ultra product versions GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions
  • Verify inventory for potential vulnerability
  • Review and implement compensating controls for insufficient access control

Evidence notes

The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability. ZTE provides a reference for affected products.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108503 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108503

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108503 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108503

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.