Dynamic Authentication Vulnerability in SmartLife App from ZTE
CVE-2026-86552

4.3MEDIUM

Key Information:

Vendor

Zte

Status
Ztesw
Vendor
CVE Published:
20 September 2026

What is CVE-2026-86552?

The SmartLife app has a significant vulnerability where it dynamically generates authentication parameters at runtime. This flaw allows attackers to obtain valid authentication credentials, enabling them to complete account registrations with any arbitrary email address. Notably, the application does not verify the ownership of the email prior to registration, exposing users to potential misuse and unauthorized access.

Affected Version(s)

ZTESW ZTE_SL_V2.8.2_ABROAD and prior versions

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bullet...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mina Nageh Salama Zekry
.