CVE-2026-86553

CVE-2026-86553 is an improper privilege management flaw (CWE-269) in the authentication of the SmartLife mobile application and its cloud account backend, rated 8.5 High. The app dynamically generates fresh application authentication parameters in its runtime process; an attacker who obtains these parameters (e.g., by operating or instrumenting the app with a low-privilege account) can call the backend endpoint /account/verify.serv and submit a victim's registered email address to resolve it to the real account ID. By then presenting spoofed application authentication information together with that target account ID, the attacker can reset the victim's password and take over the account, gaining control of the account data and any smart-home devices or services linked to it. All users of the affected SmartLife app and its cloud account service are potentially exposed, and the changed-scope, network-vector CVSS score reflects that one authenticated attacker can compromise other users' accounts. Exploitation status is currently quiet: no public proof-of-concept is known and the vulnerability is not listed in CISA's KEV catalog.

What to do: Update the SmartLife app to the latest available release and monitor ZTE's PSIRT advisory for the announcement of a patched version, since no fixed version number is published yet. In the meantime, users should use a unique password for the account, enable multi-factor authentication if offered, and treat unexpected password-reset emails as a sign of targeting. Defenders and the service operator can watch for anomalous patterns such as one source repeatedly calling /account/verify.serv to resolve many email addresses to account IDs.