SmartLife App Privilege and Auth Escalation

Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.

ZTE SmartLife's backend signup interface (/account/person/signup.serv) creates accounts for arbitrary email addresses without verifying that the requester owns the address, so an attacker who has extracted the app's runtime-generated authentication parameters can complete registration against any email string. The assigned vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) and our independent assessment agree on moderate severity: the primary barrier is first obtaining the client-generated app authentication parameters - obtainable via reverse engineering or traffic interception and reflected as PR:L - with no per-victim credentials, user interaction, or non-default configuration required and the endpoint network-reachable. No KEV entry and no public exploit identified at time of analysis, so real-world urgency is genuinely low, though the integrity impact on account/identity assurance is real anywhere the platform subsequently trusts the registered email for identity, notifications, or recovery.