CVE-2026-86554

4.3 MEDIUM

Published 2026-09-20 · Updated 2026-09-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-269

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840113

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.