CVE-2026-8029: low-severity vulnerability in ZTE SmartLife
SQL Injection Vulnerability in ZTE SmartLife App
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.9epss 0.2%
The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the theft of local privacy data.
CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
ZTE · SmartLifeRelated CVEs — ZTE SmartLife
In the same product, most dangerous first.
CVE-2026-86553HIGHA password reset vulnerability in ZTE SmartLife APPEPSS 0.5%CVE-2026-86552MEDIUMA vulnerability that skips email ownership verification for account registration in ZTE SmartLife APPEPSS 0.4%CVE-2026-86554MEDIUMEmail enumeration and account ID leakage vulnerabilities in ZTE SmartLife APPEPSS 0.3%CVE-2026-86555MEDIUMHardcoded Key Vulnerability in ZTE SmartLife APPEPSS 0.2%