CVE-2026-86554

MEDIUMCVSS 4.3

Description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

Timeline

Published:September 20th, 2026 8:16 AM

Last modified:September 22nd, 2026 7:41 PM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-269

References & Reports

Advisories, patches, and third-party reports

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840113

Source: NIST NVD · Data may lag official sources by up to one minute