Detections
Analytics
CVE-2026-86554
medium
Description
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
References
https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840113