ZTE SmartLife: Four Vulnerabilities and Account Takeover via Password Reset

Researcher Mina Nageh Salama discovered a chain of four vulnerabilities in the ZTE SmartLife app that enabled account takeover without knowing the password.

The entry point was CVE-2026-86555: the Android app contained a hardcoded AES-128-GCM key that could be used to decrypt result.data returned by the public /api/getUacSignInfo endpoint. This exposed the client key, shared secret, access key, identifiers, and other data required to reconstruct a valid SmartLife app-auth context.

Next, CVE-2026-86554 made it possible to use /account/verify.serv to determine whether a given email address was registered and, for a registered account, obtain its internal accountId.

The key issue, CVE-2026-86553, was in /account/password/reset.serv: the endpoint accepted an accountId and a new password without requiring the old password, a reset code, or a verified reset transaction. The researcher tested the chain on his own account — the old password stopped working after the reset, while the attacker-selected new password produced a valid SmartLife session.

The fourth issue, CVE-2026-86552, allowed an arbitrary email address to be registered before ownership of the mailbox was verified, creating an account-squatting opportunity. Static analysis showed that the token and accountId obtained after login are passed to the ZTE Homecare SDK, which exposes APIs for homes, devices, cameras, sensors, sharing, cloud-to-device commands, and other functionality. However, the author confirmed exploitation only of the account flow; the broader Homecare attack surface was mapped through static analysis rather than exploited.

Account deletion without a user token was also observed on an earlier runtime-selected backend. However, ZTE stated that this behavior was limited to a test environment and that the production path requires a token, so it was excluded from the four production CVEs.

All four confirmed vulnerabilities have been fixed by ZTE. The author published technical details and PoCs, with live validation performed only against researcher-controlled accounts.

Article: https://minanagehsalalma.github.io/zte-smartlife-app-pwned/

PoC: https://github.com/minanagehsalalma/zte-smartlife-app-pwned