CVE-2026-86551

LowCVSS 3.3/10Last modified Sep 22, 2026

Description

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-668

Affected software

VendorProductVersions
ZTENX741JGEN_ZTE_PQ85A01V1.0.0B23MR3 and all prior released versions

References

Timeline

Published
Sep 20, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-865525.4SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife applicCVE-2026-865538.8SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmaCVE-2026-865544.3SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained CVE-2026-865556.2The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. OnCVE-2026-865565.3There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerabilityCVE-2026-86566.1Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper CVE-2026-865616.5A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to CVE-2026-865627.8A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlleCVE-2026-865637.8A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.CVE-2026-865643.3A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause CVE-2026-865658.2A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds wCVE-2026-865666.5A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of ser