CVE-2026-86554

Katalog CVE

CVSS 4.3 · Medium EPSS 0,33%

Kerentanan Improper Privilege Management. Skor CVSS 3.1 4.3 (Medium) menurut zte.com.cn.

Deskripsi (NVD)

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

Rincian

Terbit di NVD

20 September 2026

Terakhir diubah

22 September 2026

Status NVD

Deferred

CVSS 3.1

4.3 (Medium), sumber zte.com.cn
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840113