SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its…

#!/usr/bin/env python3
"""check_smartlife.py — CVE-2026-86553 version checker for ZTE SmartLife.
Outputs: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
"""
import subprocess
import sys
import re
import argparse
import zipfile
import xml.etree.ElementTree as ET

PACKAGE = "com.zte.smarthome.abroad"
FIXED_VERSION = (2, 8, 4)  # v2.8.4 is the first patched release

def parse_version(ver_str):
    """Parse dotted version string into tuple of ints."""
    parts = re.findall(r'\d+', ver_str)
    return tuple(int(p) for p in parts) if parts else None

def check_via_adb():
    """Check installed SmartLife version via ADB."""
    try:
        result = subprocess.run(
            ["adb", "shell", "dumpsys", "package", PACKAGE],
            capture_output=True, text=True, timeout=15
        )
    except FileNotFoundError:
        print("[!] adb not found on PATH. Install Android platform-tools.")
        return "UNKNOWN"
    except subprocess.TimeoutExpired:
        print("[!] ADB command timed out. Check device connection.")
        return "UNKNOWN"

    if result.returncode != 0 or PACKAGE not in result.stdout:
        print(f"[*] {PACKAGE} is NOT installed on the connected device.")
        return "PATCHED"  # Not installed = not vulnerable

    match = re.search(r'versionName=([\d.]+)', result.stdout)
    if not match:
        print("[!] Could not parse versionName from package info.")
        return "UNKNOWN"

    ver_str = match.group(1)
    ver = parse_version(ver_str)
    print(f"[*] Installed version: {ver_str}")

    if ver is None:
        return "UNKNOWN"
    if ver >= FIXED_VERSION:
        return "PATCHED"
    return "VULNERABLE"

def check_via_apk(apk_path):
    """Check SmartLife version from an APK file."""
    try:
        with zipfile.ZipFile(apk_path, 'r') as zf:
            # Try to read AndroidManifest.xml (binary XML)
            # Fallback: use aapt if available
            pass
    except Exception:
        pass

    # Use aapt for reliable version extraction
    try:
        result = subprocess.run(
            ["aapt", "dump", "badging", apk_path],
            capture_output=True, text=True, timeout=15
        )
        match = re.search(r"versionName='([^']+)'", result.stdout)
        if match:
            ver_str = match.group(1)
            ver = parse_version(ver_str)
            print(f"[*] APK version: {ver_str}")
            if ver is None:
                return "UNKNOWN"
            if ver >= FIXED_VERSION:
                return "PATCHED"
            return "VULNERABLE"
    except FileNotFoundError:
        print("[!] aapt not found. Install Android build-tools or use --adb mode.")
    except subprocess.TimeoutExpired:
        print("[!] aapt timed out.")

    return "UNKNOWN"

def main():
    parser = argparse.ArgumentParser(
        description="Check for CVE-2026-86553 (ZTE SmartLife password reset bypass)")
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument("--adb", action="store_true",
                       help="Check via ADB on connected Android device")
    group.add_argument("--apk", type=str,
                       help="Path to SmartLife APK file to inspect")
    args = parser.parse_args()

    print(f"[*] CVE-2026-86553 — ZTE SmartLife password reset bypass")
    print(f"[*] Fixed in: >= {'.'.join(str(v) for v in FIXED_VERSION)}")
    print()

    if args.adb:
        status = check_via_adb()
    else:
        status = check_via_apk(args.apk)

    print()
    print(f"[RESULT] {status}")

    if status == "VULNERABLE":
        print("[!] Update ZTE SmartLife to v2.8.4+ immediately.")
        sys.exit(1)
    elif status == "PATCHED":
        print("[+] No action required.")
        sys.exit(0)
    else:
        print("[?] Could not determine status. Manual review required.")
        sys.exit(2)

if __name__ == "__main__":
    main()