Description

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-20T02:16:51.310Z",
  "pubdate": "2026-09-20T02:16:51.310Z",
  "executiveSummary": "The Z80Ultra (NX741J) suffers from an information disclosure vulnerability within the Settings.Secure database.\nNon-privileged applications can access the factory_mac_address field without requiring elevated system or signature-level permissions.\nThis vulnerability exposes the unique hardware Wi-Fi MAC address to potentially malicious third-party software installed on the device.\nThe primary risk involves unauthorized device fingerprinting and tracking of users across different networks and sessions.\nExploitation requires no specific authentication or user interaction; the attacker simply needs to execute a query against the Android Settings provider.\nThis represents a breach of the principle of least privilege, as hardware identification data should be restricted to system-level processes or apps holding specific signature-level permissions.",
  "technicalDetails": "The vulnerability resides within the Android Settings provider architecture of the Z80Ultra (NX741J). The Settings.Secure database is intended to store sensitive system-wide configuration settings that typically require elevated privileges or specific system-level permissions to modify or read.\nThe root cause is an improper implementation of access control policies regarding the 'factory_mac_address' field. Specifically, the ContentProvider that manages access to Settings.Secure fails to enforce a permission check for read operations targeting this specific key.\nIn the Android framework, the Settings.Secure class functions as a central repository for system settings. Under normal circumstances, queries to secure settings are constrained by the underlying ContentProvider implementation. In the case of the Z80Ultra (NX741J), the query mechanism allows any application—including those without 'android.permission.READ_PHONE_STATE' or system-uid status—to fetch the value of the 'factory_mac_address' field.\nThe exploitation flow is straightforward: an attacker develops a non-privileged application that executes a standard query against the 'content://settings/secure' URI. By specifying 'factory_mac_address' as the selection argument, the application can programmatically retrieve the Wi-Fi hardware MAC address.\nBecause the data is stored in a plain-text accessible field within the Secure database, no decryption or complex exploit primitives are required to perform the data extraction. The vulnerability is effective because the underlying framework fails to distinguish between internal system processes and third-party applications when processing ContentResolver queries for this specific database key.\nPost-exploitation impact includes the permanent identification of the physical device. Unlike temporary tokens, a MAC address is tied to the network interface controller, allowing for persistent cross-app tracking, device profiling, and the potential correlation of user behavior across disparate software environments. Given that this information is retrieved from the firmware-defined factory settings, it provides a reliable and immutable hardware identifier for malicious actors.\nNo network exposure is required for the initial data exfiltration, as the attack is performed locally on the device. However, once the MAC address is obtained, it can be exfiltrated to a remote command-and-control server, facilitating wider tracking capabilities."
}