AI analysis
CVE-2026-86553 is an improper privilege management flaw (CWE-269) in the authentication of the SmartLife mobile application and its cloud account backend, rated 8.5 High. The app dynamically generates fresh application authentication parameters in its runtime process; an attacker who obtains these parameters (e.g., by operating or instrumenting the app with a low-privilege account) can call the backend endpoint /account/verify.serv and submit a victim's registered email address to resolve it to the real account ID. By then presenting spoofed application authentication information together with that target account ID, the attacker can reset the victim's password and take over the account, gaining control of the account data and any smart-home devices or services linked to it. All users of the affected SmartLife app and its cloud account service are potentially exposed, and the changed-scope, network-vector CVSS score reflects that one authenticated attacker can compromise other users' accounts. Exploitation status is currently quiet: no public proof-of-concept is known and the vulnerability is not listed in CISA's KEV catalog.
What to do: Update the SmartLife app to the latest available release and monitor ZTE's PSIRT advisory for the announcement of a patched version, since no fixed version number is published yet. In the meantime, users should use a unique password for the account, enable multi-factor authentication if offered, and treat unexpected password-reset emails as a sign of targeting. Defenders and the service operator can watch for anomalous patterns such as one source repeatedly calling /account/verify.serv to resolve many email addresses to account IDs.
Affected
| ZTE SmartLife mobile app and its cloud account backend (endpoint /account/verify.serv) | — |
Estimated exposure
unknown — plausibly hundreds of thousands to millions of app users if this is a mass-market consumer smart-home client, but no install or user counts are… — The source data provides no active-install, device, or subscriber counts for the SmartLife app, and no fixed version or user-base figures have been published, so no firm order of magnitude can be established.
Description
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.