CVE-2026-86553 — A password reset vulnerability in ZTE SmartLife APP

Description (CNA)

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

Affected (CNA)

Vendor / product	Versions
ZTE / SmartLife	affected ZTE_SL_V2.8.2_ABROAD and prior versions

CWE

CWE-269

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840100

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.