Medium severity · published Sep 20, 2026
CVE-2026-86552
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SmartLife · ZTE
ZTE_SL_V2.8.2_ABROAD and prior versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86552
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86552
support.zte.com.cn
https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982102946
More from SmartLife
8.8
CVE-2026-86553
A password reset vulnerability in ZTE SmartLife APP
6.2
CVE-2026-86555
Hardcoded Key Vulnerability in ZTE SmartLife APP
4.3
CVE-2026-86554
Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP
3.9
CVE-2026-8029
SQL Injection Vulnerability in ZTE SmartLife App