The SmartLife mobile application generates authentication parameters on‑the‑fly during runtime. By capturing these temporary tokens, an attacker can call the backend endpoint /account/verify.serv and retrieve the true account ID for a user’s email address. Using these credentials together with forged authentication data, the attacker can reset the target account’s password, effectively taking over the account. This flaw represents improper privilege management (CWE‑269).

The vulnerability affects the ZTE SmartLife mobile application (ZTE:ZTESW). Specific affected versions are not listed in the vendor’s advisory, so all releases prior to the latest patch may be susceptible.

The CVSS score of 8.8 indicates a high severity. No EPSS score is publicly available, and the issue is not listed in the CISA KEV catalog. The flaw can be exploited remotely by intercepting or forging authentication tokens from the mobile app and then contacting the backend endpoint. An attacker needs only to craft a valid request and supply the target account ID; no local privilege escalation is required. The availability of the backend interface makes this vulnerability a realistic risk for account takeover.