CVE-2026-86552

5.4 MEDIUM

Published 2026-09-20 · Updated 2026-09-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weaknesses

CWE-269

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982102946

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.