CVE-2026-86552

MEDIUMCVSS 5.4

Description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

Timeline

Published:September 20th, 2026 4:17 AM

Last modified:September 22nd, 2026 7:41 PM

CVSS Scoring

CVSS v3: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-269

References & Reports

Advisories, patches, and third-party reports

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982102946

Source: NIST NVD · Data may lag official sources by up to one minute