Medium severity · published Sep 20, 2026
CVE-2026-86555
Hardcoded Key Vulnerability in ZTE SmartLife APP
6.2
CVSS
0.2%
EPSS
No
On KEV
Description
The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SmartLife · ZTE
ZTE_SL_V2.8.2_ABROAD and earlier versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86555
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86555
support.zte.com.cn
https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/874505866159007054
More from SmartLife
8.8
CVE-2026-86553
A password reset vulnerability in ZTE SmartLife APP
5.4
CVE-2026-86552
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
4.3
CVE-2026-86554
Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP
3.9
CVE-2026-8029
SQL Injection Vulnerability in ZTE SmartLife App