CVE-2026-86554 — Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP

CVE-2026-86554

Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP PUBLISHED

Description (CNA)

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

Affected (CNA)

Vendor / product	Versions
ZTE / SmartLife	affected ZTE_SL_V2.8.2_ABROAD and prior versions

CWE

CWE-269

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840113

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.