Ztesw
Monthly
Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.
Information disclosure in ZTE SmartLife allows an attacker who can extract the app's runtime-generated application authentication parameters to query the backend /account/verify.serv endpoint, confirm whether a target email address is registered, and retrieve the corresponding real backend account ID. The independent assessment treats the issue as network-reachable and unauthenticated from the backend's perspective because those parameters are obtainable by running or reverse-engineering the SmartLife client, though the practical impact is limited to email enumeration and account-ID leakage in ZTE's SmartLife ecosystem, not a full privilege escalation. No CISA KEV entry and no public exploit were identified at time of analysis.
ZTE SmartLife's backend signup interface (/account/person/signup.serv) creates accounts for arbitrary email addresses without verifying that the requester owns the address, so an attacker who has extracted the app's runtime-generated authentication parameters can complete registration against any email string. The assigned vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) and our independent assessment agree on moderate severity: the primary barrier is first obtaining the client-generated app authentication parameters - obtainable via reverse engineering or traffic interception and reflected as PR:L - with no per-victim credentials, user interaction, or non-default configuration required and the endpoint network-reachable. No KEV entry and no public exploit identified at time of analysis, so real-world urgency is genuinely low, though the integrity impact on account/identity assurance is real anywhere the platform subsequently trusts the registered email for identity, notifications, or recovery.
Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.
Information disclosure in ZTE SmartLife allows an attacker who can extract the app's runtime-generated application authentication parameters to query the backend /account/verify.serv endpoint, confirm whether a target email address is registered, and retrieve the corresponding real backend account ID. The independent assessment treats the issue as network-reachable and unauthenticated from the backend's perspective because those parameters are obtainable by running or reverse-engineering the SmartLife client, though the practical impact is limited to email enumeration and account-ID leakage in ZTE's SmartLife ecosystem, not a full privilege escalation. No CISA KEV entry and no public exploit were identified at time of analysis.
ZTE SmartLife's backend signup interface (/account/person/signup.serv) creates accounts for arbitrary email addresses without verifying that the requester owns the address, so an attacker who has extracted the app's runtime-generated authentication parameters can complete registration against any email string. The assigned vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) and our independent assessment agree on moderate severity: the primary barrier is first obtaining the client-generated app authentication parameters - obtainable via reverse engineering or traffic interception and reflected as PR:L - with no per-victim credentials, user interaction, or non-default configuration required and the endpoint network-reachable. No KEV entry and no public exploit identified at time of analysis, so real-world urgency is genuinely low, though the integrity impact on account/identity assurance is real anywhere the platform subsequently trusts the registered email for identity, notifications, or recovery.