Low severity · published Aug 5, 2026
CVE-2026-8029
SQL Injection Vulnerability in ZTE SmartLife App
3.9
CVSS
0.2%
EPSS
No
On KEV
Description
The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the theft of local privacy data.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SmartLife · ZTE
ZTE_SL_V5.0.7and all prior released versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8029
support.zte.com.cn
https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/874505866159001729
More from SmartLife
8.8
CVE-2026-86553
A password reset vulnerability in ZTE SmartLife APP
6.2
CVE-2026-86555
Hardcoded Key Vulnerability in ZTE SmartLife APP
5.4
CVE-2026-86552
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
4.3
CVE-2026-86554
Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP