Vulnerabilidades do ZTE SmartLife

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam ZTE SmartLife: 5 registro(s), com versões afetadas e correções.

CVE-2026-86555 Média · 6.2 CWE-798 20/09/2026

Hardcoded Key Vulnerability in ZTE SmartLife APP

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.

CVE-2026-86554 Média · 4.3 CWE-269 20/09/2026

Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

CVE-2026-86553 Alta · 8.8 CWE-269 20/09/2026

A password reset vulnerability in ZTE SmartLife APP

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

CVE-2026-86552 Média · 5.4 CWE-269 20/09/2026

A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

CVE-2026-8029 Baixa · 3.9 CWE-89 05/08/2026

SQL Injection Vulnerability in ZTE SmartLife App

The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the theft of local privacy data.