CVE-2026-86552

Published Sep 20, 2026·Updated Sep 20, 2026

NVD Description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

Public Exploits & PoCs1 found

PoC: zte-smartlife-app-pwned

ZTE SmartLife security findings leading to account takeover: CVE-2026-86552, CVE-2026-86553, CVE-2026-86554, and CVE-2026-86555.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free