ZTE SmartLife Flaws Let Attackers Hijack Accounts by Resetting Passwords Without Verification

ZTE has addressed four vulnerabilities in its SmartLife mobile application following the discovery of critical weaknesses that allowed attackers to enumerate accounts, retrieve account identifiers, reset passwords, and take over user accounts.

The most severe vulnerability, labeled as CVE-2026-86553, was assigned a CVSS score of 8.8 and affected ZTE SmartLife versions 2.8.2 and earlier.

This vulnerability enabled a password reset request to be executed successfully using a target account ID and a new password, without requiring any confirmation that the requester owned the account or had completed a reset-code verification process.

The vulnerable password reset process failed to implement a standard server-side verification procedure. Typically, a password reset requires a code sent to the account owner for validation or another form of user authentication before allowing a new password to be set.

However, the SmartLife backend accepted a password reset solely based on an account identifier and a new password. This lack of adequate verification created a pathway for account takeovers, especially when paired with an email enumeration issue.

According to the CVE description, attackers with access to SmartLife application authentication parameters could query the /account/verify.serv backend interface to check if an email address was registered.

When a valid account was entered, the API would also return the backend account ID, which an attacker could then use, along with spoofed authentication data, to reset the victim’s password successfully.

The researcher only validated this issue with accounts they controlled, but once the password change was executed, the new credentials could authenticate to the SmartLife service, confirming that the password change directly affected the account.

ZTE SmartLife Vulnerabilities

The flaws were uncovered by security researcher Mina Nageh Salama while examining the SmartLife ecosystem in conjunction with research on ZTE router firmware (H188A and H288A). This investigation led to a focus on the cloud account services used by the official ZTE SmartLife Android app.

In total, the coordinated disclosure resulted in four CVEs, and ZTE confirmed that all identified issues had been remediated.

The email enumeration vulnerability, CVE-2026-86554, permitted attackers to differentiate between registered and unregistered SmartLife email addresses.

If an attacker supplied a registered email, the backend disclosed the account’s real backend identifier, making the password reset issue more exploitable.

Vulnerability CVE-2026-86555 involved a hardcoded key within the SmartLife application, which could be extracted to decrypt sensitive account-server information.

These flaws hold significant implications. The broader concern was that the backend system relied too heavily on application-level authentication for critical account actions.

While such authentication can indicate that a request may come from an authorized application context, it should not replace the need for robust proof that the requester controls the specific account being altered.

A compromised SmartLife account could expose various user-connected home environments, as the SmartLife application manages numerous home and device configurations. Therefore, account compromise can lead to more serious repercussions extending beyond mere access to user profiles.

To address these vulnerabilities, ZTE announced that it fully patched all reported issues, with advisories issued on September 20, 2026.

SmartLife users should update to the latest version in official app stores and consider changing passwords, especially if they reused them across services.

Additionally, reviewing connected devices and shared-home members is critical to maintaining security. For vendors, this case underscores the essential principle that password resets must include server-side verification to protect accounts.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC