Security researcher Mina Nageh Salama disclosed a chain of vulnerabilities in ZTE’s SmartLife platform that lets attackers take over user accounts by resetting passwords without a verification code.
ZTE confirmed four flaws, issued CVE identifiers, and said it fully patched the vulnerabilities on September 3, 2026. However, users must apply security updates to protect their devices.
The most serious issue, tracked as CVE-2026-86553 and rated 8.8 on the CVSS scale by ZTE, affected SmartLife’s password-reset process. Salama found that the backend accepted an account identifier and a new password without requiring the user’s old password, a verified reset code, or another server-side proof that the requester controlled the account.
The research began while Salama was examining firmware for ZTE H188A and H288A routers before expanding into the SmartLife Android application and its cloud account infrastructure. He analyzed SmartLife version 2.8.1 with JADX and inspected the application at runtime using Frida on a rooted Android 12 emulator.
ZTE SmartLife is the company’s mobile platform for managing connected-home products and services on Android or iPhone devices.
The attack chain relied on several weaknesses working together.
CVE-2026-86555 involved cryptographic material embedded in the SmartLife application. An attacker could recover a hardcoded AES key from the Android client and use it to decrypt information returned by a publicly accessible bootstrap service. That data contained additional application credentials used to construct requests that the SmartLife backend recognized as originating from an authorized client.
Application authentication alone should not authorize changes to an individual user account. However, other flaws broke that distinction.
CVE-2026-86554 allowed the account-verification API to distinguish registered email addresses from unregistered ones and, for existing users, disclose the associated backend account identifier.
An attacker able to reconstruct the application authentication context could therefore identify an account and submit its identifier to the vulnerable password-reset endpoint. Salama demonstrated the issue using researcher-controlled accounts, showing that the old password stopped working after the reset while the attacker-selected password successfully generated a valid SmartLife session.
A fourth issue, CVE-2026-86552, allowed email addresses to be registered before mailbox ownership had been verified, creating an account-squatting risk.
Salama also observed an account-deletion weakness during earlier testing, but ZTE said the affected path belonged to a test environment and that production requires a user token. It was therefore excluded from the four confirmed CVEs.
Static analysis of the SmartLife application showed that authenticated accounts can access a much broader Homecare ecosystem containing APIs for homes, rooms, device inventories, sharing, cameras, sensors, MQTT command forwarding, and device upgrades. The research did not demonstrate compromise of all those functions, but showed why obtaining a valid SmartLife session could have consequences beyond profile access.
Salama first reported the vulnerabilities to ZTE PSIRT on May 18. Following additional evidence, runtime testing, and roughly 50 disclosure emails, ZTE confirmed the findings in August and published security advisories on September 20.
SmartLife users should install the latest available version of the application, use a unique account password, and review their account and connected-device configuration for unexpected changes.
Leave a Reply