ZTE SmartLife Flaws Let Attackers Hijack Accounts by Resetting Passwords Without Verification
ZTE patched four SmartLife flaws, including an 8.8-severity password reset that enables account takeover.
ZTE patched four SmartLife vulnerabilities affecting versions 2.8.2 and earlier, with advisories issued on September 20, 2026. CVE-2026-86553 (CVSS 8.8) accepts a password reset from an account ID and a new password without proving ownership or checking a reset code. Related flaws allow email enumeration that returns backend account IDs (CVE-2026-86554, CVSS 4.3), fake registration via an email-verification bypass (CVE-2026-86552, CVSS 5.4), and extraction of a hardcoded app key (CVE-2026-86555, CVSS 6.2). Researcher Mina Nageh Salama validated the reset only on accounts they controlled.
- CVE-2026-86553 (CVSS 8.8) resets passwords without owner verification.
- Email lookup CVE-2026-86554 returns the backend account identifier.
- Hardcoded app key CVE-2026-86555 can expose account-server information.
- ZTE says all four issues were patched by September 20, 2026.
- Compromised accounts can control linked SmartLife home devices.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86552 | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime | 5.4 | — | ||
| CVE-2026-86553 | Broken Authentication in ZTE SmartLife App Enables Account Takeover | 8.8 | — | ||
| CVE-2026-86554 | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process | 4.3 | — | ||
| CVE-2026-86555 | The ZTE SmartLife application has a hardcoded key | 6.2 | — |
From the original article
3 min read at cybersecuritynews.com
ZTE has addressed four vulnerabilities in its SmartLife mobile application following the discovery of critical weaknesses that allowed attackers to enumerate accounts, retrieve account identifiers, reset passwords, and take over user accounts. The most severe vulnerability, labeled as CVE-2026-86553, was assigned a CVSS score of 8. 8 and affected ZTE SmartLife versions 2.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.