CVE-2026-86554mediumCWE-269

CVE-2026-86554: falha de média gravidade em ZTE SmartLife

Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SmartLife

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
ZTE · SmartLife
CVEs relacionadas — ZTE SmartLife

No mesmo produto, das mais perigosas para as menos.

CVE-2026-86553HIGHA password reset vulnerability in ZTE SmartLife APPEPSS 0.5%CVE-2026-86552MEDIUMA vulnerability that skips email ownership verification for account registration in ZTE SmartLife APPEPSS 0.4%CVE-2026-8029LOWSQL Injection Vulnerability in ZTE SmartLife AppEPSS 0.2%CVE-2026-86555MEDIUMHardcoded Key Vulnerability in ZTE SmartLife APPEPSS 0.2%