I Could Takeover Any ZTE SmartHome Account Without a Reset Code. 4 CVEs, 100K+ Android Downloads

I was originally looking at ZTE router firmware and ended up following the SmartLife side into the account API used by the Android app. After reversing the app and reconstructing its application authentication, I started testing the account flows with my own accounts. The password reset endpoint accepted an accountId and a new password without asking for the reset code, old password, or a verified reset transaction. The account verification endpoint could also tell me whether an email was registered and return the backend accountId. On my test account I could enumerate the account, get the ID, change the password, then log in with the password I had just set. The old password stopped working. ZTE confirmed the findings, patched them, and assigned four CVEs: CVE-2026-86552 CVE-2026-86553 CVE-2026-86554 CVE-2026-86555 The reset issue, CVE-2026-86553, received a CVSS score of 8.8 High. The Android app had 100K+ downloads on Google Play alone at the time of the research. I wrote up the reversing, Frida work, request flow, PoC sequence, SDK surface and disclosure timeline here: submitted by /u/TheReedemer69 [link] [comments]

from hacking: security in practice https://ift.tt/3P0KMWs