Knowing a ZTE SmartLife email address is enough for demonstrated account takeover.

Recoverable client secrets enable signed requests, an oracle returns the backend account ID, and the reset endpoint accepts a new password without a verified reset transaction. The researcher reproduced password replacement and login against controlled accounts. A fix is published, but it was not reviewed for this brief, so this cannot lead.