CVE-2026-86553

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-20

Last updated on: 2026-09-22

Assigner: ZTE Corporation

Description

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-20

Last Modified

2026-09-22

Generated

2026-10-10

AI Q&A

2026-09-20

EPSS Evaluated

2026-10-09

NVD

CVE-2026-86553

EUVD

EUVD-2026-83649

Affected Vendors & Products

Vendor	Product	Version / Range
ZTE	SmartLife	ZTE_SL_V2.8.2_ABROAD and prior versions

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in the SmartLife app allows attackers to generate authentication parameters during runtime. By exploiting this, they can call a backend interface to retrieve the real account ID linked to a registered email address. This enables attackers to spoof authentication and reset the target account's password.

Detection Guidance

This vulnerability involves SmartLife app authentication parameters being generated dynamically and potentially exposed. To detect it, monitor network traffic for unusual requests to /account/verify.serv endpoints, especially those including authentication parameters and email/account ID pairs. Check for repeated password reset attempts or unauthorized access to accounts. Inspect SmartLife app runtime processes for suspicious parameter generation activities.

Impact Analysis

If you use the SmartLife app, an attacker could gain unauthorized access to your account by resetting your password. This could lead to data theft, unauthorized actions, or loss of control over your account and associated data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using SmartLife may face compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update the SmartLife app to the latest version if an update is available. Disable or restrict access to the backend interface /account/verify.serv if possible. Monitor network traffic for unusual requests to this interface. Implement strong authentication mechanisms and rate limiting to prevent brute force attacks.

Hi! I’m here to help you understand CVE-2026-86553. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70