Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86554

Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP

CVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86554

Published

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86554

Published

SmartLife

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ZTE",
                    "product": "SmartLife",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "ZTE_SL_V2.8.2_ABROAD and prior versions"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON