Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.3

ZTE Z80Ultra can expose its Wi‑Fi MAC address

CVE-2026-86551 · published 29 days ago
Summary

On the ZTE Z80Ultra (model NX741J), any program without special privileges can read the device’s Wi‑Fi MAC address from a system setting. This information can be used to identify or track the device, potentially compromising privacy. Apply the vendor’s update or limit app access to system settings to mitigate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
zte nx741j GEN_ZTE_PQ85A01V1.0.0B23MR3 and all prior released versions
Original advisory text
Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product
The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-668Exposure of Resource to Wrong Sphere
Timeline
Published20 Sep 2026
Updated19 Oct 2026
First seen20 Sep 2026
Sources
CVE-2026-86551 · NVD
CVE-2026-86551 · MITRE
Track software like this
Free during beta