EUVD-2026-83717
GHSA-6rhq-q57h-9phf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain SmartLife app binary
-
ExploitReverse-engineer and locate hardcoded key
-
ExecutionDecrypt embedded account-server data
-
ImpactExpose backend server information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the ZTE SmartLife application code/binary (AV:L) in order to statically extract the plaintext hardcoded decryption key; once the key is recovered it can decrypt the embedded account-server information. The limiting factor is that the attacker must first obtain and reverse-engineer the app package - there is no remote network-triggerable path despite the PR:N rating, and the exposed data is backend server information rather than per-user credentials. No special server-side configuration or user interaction is required. |
| Impact | This is a lower-priority, defense-in-depth issue rather than an urgent, remotely-weaponizable flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 6.2) is confidentiality-only with a LOCAL attack vector - despite PR:N, an attacker must first obtain the application binary/code to extract the hardcoded key, which constrains real-world exploitability. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so the practical urgency is well below what a 'MEDIUM' CVSS might suggest. Note a signal conflict worth verifying with the vendor: the C:H rating appears high given the description only mentions exposure of 'account server information' (server endpoint/config data), not user account data or secrets - C:L may be more accurate, which would lower the score. This is the least severe of a related ZTE SmartLife batch, providing recon/infrastructure detail that supports the sibling account-enumeration (CVE-2026-86554) and account-takeover (CVE-2026-86553) issues rather than causing direct compromise on its own. |
| Exploit ScenarioDerived | An attacker obtains the ZTE SmartLife app package and reverse-engineers it, locating the hardcoded decryption key stored in plaintext in the code. Using that key, they decrypt the embedded account-server information, exposing backend server details. No public exploit code is currently available, and the local attack vector means the attacker needs access to the app binary first. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
The ZTE SmartLife client application ships with a hardcoded cryptographic key stored in plaintext within its code, allowing anyone who obtains and reverse-engineers the app package to recover the key and decrypt the embedded account-server information. Exploitation is local in nature - the attacker must first acquire the application binary and perform static analysis - and what is exposed is backend account-server configuration data rather than per-user credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor scores this 6.2 with high confidentiality impact, while independent assessment rates confidentiality impact as Low, framing this as a defense-in-depth weakness rather than an urgent, remotely-weaponizable flaw.
RemediationAI
No vendor-released patch is identified in the available data, so confirm the fixed build and version through the ZTE bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/874505866159007054 before upgrading, and track the CVE for a corrected SmartLife release that removes the embedded key. Because the exposed secret is client-side and cannot be protected once shipped, the effective mitigation is remediation on the server side: rotate or revoke the affected account-server encryption key and any credentials or endpoints it protects, then replace the static embedded key with key material provisioned at runtime or held server-side - the trade-off is a coordinated server-and-client change and re-issuance effort, but it is the only way to invalidate the already-leaked value. Treat the account-server connection details as public information and harden those endpoints accordingly by enforcing mutual TLS, IP allowlisting, and strong authentication on the backend, accepting the operational overhead of managing certificates and allowlists. Client-side obfuscation or packer hardening of the app binary offers only marginal delay against static extraction and should not be relied on as a primary control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-798 (Use of Hard-coded Credentials) issue in which a symmetric or asymmetric key used to protect account-server details is embedded as a literal value in the ZTE SmartLife application rather than being derived at runtime, stored in a platform keystore, or fetched after authentication. Because the CPE string cpe:2.3:a:zte:smartlife:*:*:*:*:*:*:*:* uses a wildcard version, no fixed release is identified as unaffected. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and the assessed vector differ only in confidentiality impact (vendor High versus assessed Low), reflecting that the recovered key decrypts static server metadata, not user-account secrets. The local attack vector (AV:L) is the controlling constraint: the key cannot be extracted over the network, and there is no server-side configuration or user interaction that triggers disclosure.
Know when Smartlife gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:L because the key must be extracted from the local app binary; PR:N/UI:N as no auth or interaction is needed once code is held; C:L (not C:H) since only server infrastructure info, not user data, is exposed.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
DescriptionCVE.org
The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB