Skip to content
OpenAdvisories
Medium · 5.4 Public exploit CVE-2026-86552 EUVD-2026-83648GHSA-5vgr-9q5r-pvpj

A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

Published Sep 20, 2026 · Updated Sep 21, 2026 · Assigned by zte

Vendor: ZTE Product: SmartLife

Description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

Affected products

VendorProductAffectedFixed
ZTE SmartLife ZTE_SL_V2.8.2_ABROAD and prior versions —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References