{"uuid": "11451fdb-32a9-4678-ac70-080fc338e177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-34472", "type": "seen", "source": "https://gist.github.com/lcsouzamenezes/f5ec764b1e9860e9b5507f017ba9d7df", "content": "# ZTE ZXHN router vulnerabilities\n\nPublic disclosure date: 2026-03-27  \nResearcher: Mina Nageh Salama Zekry\n\nThis public reference summarizes three CVEs affecting ZTE ZXHN / H-series router web interfaces. It is intended as a clean reference for CVE and NVD records, with the full technical write-ups routed through LinkedIn posts.\n\n## Quick links\n\n- CVE-2026-34472: [technical write-up](https://www.linkedin.com/feed/update/urn:li:activity:7462839051977461761/) | [PoC](https://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router/tree/main/poc)\n- CVE-2026-34473: [technical write-up](https://www.linkedin.com/feed/update/urn:li:activity:7462444286496669696/) | [PoC](https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers/tree/main/poc)\n- CVE-2026-34474: [technical write-up](https://www.linkedin.com/feed/update/urn:li:activity:7463196643111329792/) | [PoC](https://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure/tree/main/poc)\n\n## CVE-2026-34472: ZXHN H188A V6.0 credential disclosure leading to auth bypass\n\n**Affected product:** ZTE ZXHN H188A V6.0  \n**Affected versions:** V6.0.10P2_TE, V6.0.10P3N3_TE\n\n**Summary:**  \nThe pre-login wizard routing path accepts attacker-controlled `_type` and `_tag` values on root-path requests before the normal quick-setup gate is applied. This allows unauthenticated access to credential-bearing wizard handlers.\n\n**Impact:**  \nWLAN, PPPoE, and administrator credential disclosure. On the validated H188A V6 path, the leaked Wi-Fi passphrase becomes the default administrator password when uppercased, turning the disclosure into administrative access.\n\n**Observed component / endpoint:**  \n`/?_type=tedataNotLoginData&_tag=wizard_lua.lua&IF_ACTION=...`\n\n**References:**  \n[technical write-up](https://www.linkedin.com/feed/update/urn:li:activity:7462839051977461761/) | [PoC](https://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router/tree/main/poc)\n\n## CVE-2026-34473: ZTE H-series unauthenticated denial of service\n\n**Affected products / models include:**  \nH8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, H196Q\n\n**Affected version scope:**  \nMultiple firmware versions observed across affected H-series models, including versions in use prior to 2022.\n\n**Summary:**  \nThe router web stack processes attacker-controlled `application/x-www-form-urlencoded` POST bodies before authentication gates matter. Large request bodies that stay within the configured parser budget can still reach the expensive body-read and parse path.\n\n**Impact:**  \nUnauthenticated denial of service against the web management interface. During validation, affected interfaces became unavailable and required manual reboot to recover.\n\n**References:**  \n[technical write-up](https://www.linkedin.com/feed/update/urn:li:activity:7462444286496669696/) | [PoC](https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers/tree/main/poc)\n\n## CVE-2026-34474: ZXHN H298A / H108N sensitive data exposure\n\n**Affected products:** ZTE ZXHN H298A, ZTE ZXHN H108N  \n**Affected versions:** H298A V1.1, H108N V2.6\n\n**Summary:**  \nAn unauthenticated `ETHCheat=1` request to the management page returns credential-bearing HTML on affected builds. A related wizard endpoint also exposes serial information, showing a broader unauthenticated disclosure surface.\n\n**Impact:**  \nAdministrator password and WLAN PSK disclosure, enabling management-interface compromise and Wi-Fi credential compromise on affected builds.\n\n**Observed component / endpoint:**  \n`/getpage.lua?pid=1000&ETHCheat=1`\n\n**References:**  \n[technical write-up](https://www.linkedin.com/feed/update/urn:li:activity:7463196643111329792/) | [PoC](https://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure/tree/main/poc)\n\n## Timeline\n\n- 2024-05-02: Vulnerabilities reported to ZTE PSIRT.\n- 2026: CVE IDs assigned and public records published by the CVE Program.\n", "creation_timestamp": "2026-09-25T18:07:19.000000Z"}