CVE-2026-86553: falha de alta gravidade em ZTE SmartLife
A password reset vulnerability in ZTE SmartLife APP
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.5%
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
ZTE · SmartLifeCVEs relacionadas — ZTE SmartLife
No mesmo produto, das mais perigosas para as menos.
CVE-2026-86552MEDIUMA vulnerability that skips email ownership verification for account registration in ZTE SmartLife APPEPSS 0.4%CVE-2026-86554MEDIUMEmail enumeration and account ID leakage vulnerabilities in ZTE SmartLife APPEPSS 0.3%CVE-2026-8029LOWSQL Injection Vulnerability in ZTE SmartLife AppEPSS 0.2%CVE-2026-86555MEDIUMHardcoded Key Vulnerability in ZTE SmartLife APPEPSS 0.2%