12 matches found
CVE-2026-86555
The ZTE SmartLife mobile application contains a hardcoded key used to decrypt account server information. The key is stored in plaintext within the application code, so an attacker with access to the binary can extract it and decrypt the protected server configuration data. The CVSS v3.1 score is...
CVE-2026-86555 Hardcoded Key Vulnerability in ZTE SmartLife APP
The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it...
CVE-2026-86554
ZTE SmartLife APP is affected by an email enumeration and account ID leakage vulnerability. The app dynamically generates authentication parameters in its runtime process, which an attacker with low privileges can extract and use to invoke the backend endpoint /account/verify.serv . This allows a...
CVE-2026-86552 A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...
CVE-2026-86552
CVE-2026-86552 affects the ZTE SmartLife APP , where the app dynamically generates new authentication parameters at runtime. An attacker possessing valid SmartLife authentication credentials can complete account registration with any arbitrary email address via the backend endpoint /account/perso...
PT-2026-95940
Name of the Vulnerable Software and Affected Versions SmartLife app affected versions not specified Description The application dynamically generates authentication parameters during its runtime process. An attacker who obtains these parameters can invoke the backend interface...
CVE-2026-86554: Improper Privilege Management
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email...
CVE-2026-86552: Improper Privilege Management
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...
PT-2026-95905
Name of the Vulnerable Software and Affected Versions SmartLife app affected versions not specified Description The application dynamically generates authentication parameters at runtime. An attacker who acquires these credentials can use the backend interface '/account/person/signup.serv' to...
PT-2026-95906
Name of the Vulnerable Software and Affected Versions SmartLife app affected versions not specified Description An authentication bypass exists due to the way the application dynamically generates authentication parameters within its runtime process. An attacker can acquire these parameters to...
CVE-2026-86553: Improper Privilege Management
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID...