CVE-2026-86553
A password reset vulnerability in ZTE SmartLife APP
CVSS Score
8.5
EPSS Score
0.0%
EPSS Percentile
0th
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.
| CWE | CWE-269 |
| Vendor | zte |
| Product | ztesw |
| Published | Sep 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for zte ztesw
Be the first to know when new high vulnerabilities affecting zte ztesw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
ZTE / ZTESW
ZTE_SL_V2.8.2_ABROAD and prior versions
References
Credits
Mina Nageh Salama Zekry