The ZTE Smart Life app contains an SQL injection flaw that, when exploited, allows attackers to craft UNION SELECT statements that read sensitive data from several tables in the feedback.db database such as user accounts, phone numbers, feedback content and local debug log paths. This results in the disclosure of private information; database integrity is compromised but the impact is primarily confidentiality loss, and it may allow attackers to glean sensitive personal data.

This vulnerability affects the ZTE SmartLife mobile application, specifically versions that include the unpatched database handling code. The exact affected version range is not detailed in the current advisory, so any deployed installation of the ZTE SmartLife app that has not applied the cited patch should be considered vulnerable.

The CVSS base score of 3.9 indicates a low severity overall. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation activity. The lack of a high CVSS score implies that successful exploitation likely requires the attacker to have the ability to input crafted SQL into the app’s data entry points, which is typically constrained to the app’s user interface or API. Based on the description, it is inferred that the attack vector is local, requiring the attacker to supply malicious input through the mobile app's user interface or API. However, the ability to read sensitive data through UNION SELECT means that any successful attack would result in privacy loss for the affected user.