CVE-2026-86553
A password reset vulnerability in ZTE SmartLife APP
CVSS Score
8.8
EPSS Score
0.4%
EPSS Percentile
38th
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.
| CWE | CWE-269 |
| Vendor | zte |
| Product | smartlife |
| Published | Sep 20, 2026 |
| Last Updated | Sep 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for zte smartlife
Be the first to know when new high vulnerabilities affecting zte smartlife are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
ZTE / SmartLife
ZTE_SL_V2.8.2_ABROAD and prior versions
References
Credits
Mina Nageh Salama Zekry