Medium severity · published Sep 20, 2026
CVE-2026-86554
Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SmartLife · ZTE
ZTE_SL_V2.8.2_ABROAD and prior versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86554
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86554
support.zte.com.cn
https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840113
More from SmartLife
8.8
CVE-2026-86553
A password reset vulnerability in ZTE SmartLife APP
6.2
CVE-2026-86555
Hardcoded Key Vulnerability in ZTE SmartLife APP
5.4
CVE-2026-86552
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
3.9
CVE-2026-8029
SQL Injection Vulnerability in ZTE SmartLife App