ZTE SmartLife 2.8.4 Addresses Four Account-Security Vulnerabilities

Quick Answer

ZTE published four SmartLife bulletins covering email ownership at registration, password reset, account enumeration, and a hardcoded key. The affected release is ZTE_SL_V2.8.2_ABROAD and earlier; ZTE identifies ZTE_SL_V2.8.4_ABROAD as the resolved version.

Last verified: 2026-09-20 UTC. Recheck all four ZTE bulletins before changing production or managed mobile environments.

Scope And Authority

Product scope	ZTE SmartLife application (ZTESW)
Advisories	SA-202609-1732793 / SA-202609-1732788 / SA-202609-1732784 / SA-202609-1731629
CVEs	CVE-2026-86552, CVE-2026-86553, CVE-2026-86554, and CVE-2026-86555
Authoritative release dates	2026-09-20; individual UTC-rendered timestamps are listed below
Authority revision date	2026-09-20; initial bulletins
Affected versions	ZTE_SL_V2.8.2_ABROAD and prior or earlier versions
Fixed version	ZTE_SL_V2.8.4_ABROAD
CVSS base scores	5.4 / 8.8 / 4.3 / 6.2 (CVSS v3.1)
CVSS severities	Medium / High / Medium / Medium
Exploitation status	Not stated by ZTE; no exploitation claim is inferred.

What ZTE Changed

Advisory	CVE	Release	Official score	Issue
SA-202609-1732793	CVE-2026-86552	2026-09-20 03:00:28 UTC	5.4 Medium	Email ownership is not verified before account registration.
SA-202609-1732788	CVE-2026-86553	2026-09-20 03:08:40 UTC	8.8 High	Application authentication data and an account ID can be used in a password-reset path.
SA-202609-1732784	CVE-2026-86554	2026-09-20 07:42:13 UTC	4.3 Medium	The account verification interface can expose registration status and a backend account ID.
SA-202609-1731629	CVE-2026-86555	2026-09-20 08:26:33 UTC	6.2 Medium	A hardcoded key can expose decrypted account-server information.

The four bulletins identify the same affected and resolved application releases, but this notice does not establish that their mechanisms form a single exploit chain. The password-reset issue has the group's highest official rating, High at 8.8 under CVSS v3.1. ZTE provides no workaround and directs customers to its Global Customer Support Center for the upgraded version.

What To Validate Now

1. Inventory. Identify managed SmartLife deployments, application versions, owners, distribution channels, and integrations that handle account registration or recovery.
2. Establish scope. Match the exact ABROAD release family and affected version statement; do not extend the bulletin to other ZTE applications or release families without evidence.
3. Remediate. Obtain ZTE_SL_V2.8.4_ABROAD or a supported superseding release through ZTE and deploy it through approved mobile-application controls.
4. Investigate. Review available registration, email-verification, password-reset, account-change, and administrative evidence for unexpected activity; preserve relevant server-side evidence before retention limits expire.
5. Validate. Confirm the installed application release, authentication, registration, recovery, managed configuration, backend connectivity, monitoring, and rollback readiness.

Operational Cautions

Updating the mobile application does not by itself establish whether server-side activity occurred. Coordinate application and identity teams, preserve available account evidence, and avoid forcing broad credential resets unless the organization's evidence and ZTE-supported response guidance justify that action.

Evidence To Retain

• Asset, service, environment, and owner identifiers used for the applicability decision.
• UTC timestamps and before-and-after package, application, firmware, or build versions.
• Change approval, installation output, validation results, and any exception or rollback record.
• The authoritative advisory evidence used at the time of the decision.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• ZTE PSIRT bulletin SA-202609-1732793
• ZTE PSIRT bulletin SA-202609-1732788
• ZTE PSIRT bulletin SA-202609-1732784
• ZTE PSIRT bulletin SA-202609-1731629

Correction policy: If ZTE changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.