Vulnerability · Published Sep 20, 2026 · Assigned by zte

CVE-2026-86553A password reset vulnerability in ZTE SmartLife APP

High 8.8

In plain English

A high-severity privilege mismanagement in SmartLife from ZTE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

Affected products (as reported)

Vendor	Product	Versions
ZTE	SmartLife	ZTE_SL_V2.8.2_ABROAD and prior versions

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840100