This vulnerability arises from improper privilege management in ZTE's ZTESW product. The SmartLife application generates fresh authentication parameters dynamically during runtime. An attacker who obtains these parameters can call the backend interface /account/verify.serv to retrieve the real account ID associated with a registered email address. With the ability to spoof the application authentication information and the target account ID, the attacker can reset the password of the targeted account, potentially leading to account takeover. The CVSS 3.1 score is 8.5, indicating high severity, with network attack vector, low attack complexity, low privileges required, no user interaction, and impact on confidentiality (high) and integrity (low), but no impact on availability.

An attacker can obtain real account IDs from registered email addresses and reset passwords of targeted accounts by spoofing authentication parameters. This can lead to unauthorized account access and potential compromise of sensitive user information. The vulnerability affects confidentiality and integrity of user accounts but does not impact system availability.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SmartLife app backend interfaces and monitor for suspicious activity related to account verification and password reset processes.