---
id: CVE-2026-86552
title: >-
  SmartLife app dynamically generates brand‑new SmartLife application
  authentication parameters at runtime
summary: >-
  SmartLife app dynamically generates brand‑new SmartLife application
  authentication parameters at runtime. With the acquired SmartLife application
  authentication credentials, an attacker can directly complete registration
  using any arbitr…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-269
vendor: ZTE
product: SmartLife
affected:
  - SmartLife ZTE_SL_V2.8.2_ABROAD and prior versions
published: '2026-09-20'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T19:17:14.180'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86552'
references:
  - url: >-
      https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982102946
    label: psirt@zte.com.cn
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00264
epssPercentile: 0.186
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/minanagehsalalma/zte-smartlife-app-pwned'
  checkedAt: '2026-09-21T19:52:33.223Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T18:10:40.071419Z'
ingestedAt: '2026-09-20T04:13:53.004Z'
---

## Overview

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.