Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86553

A password reset vulnerability in ZTE SmartLife APP

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86553

Published

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86553

Published

SmartLife

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ZTE",
                    "product": "SmartLife",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "ZTE_SL_V2.8.2_ABROAD and prior versions"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON