CVE-2026-86552CWE-269privilege-escalation

CVE-2026-86552

Medium · published September 20, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.6th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-09-20T08:17Z
References (1)
https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982102946 · [email protected]
EPSS history
Timeline
  • 21 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 20 SEP 03:01Z
    A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
    cvelistv5