{"vulnerability": "CVE-2021-21735", "sightings": [{"uuid": "c3d55b8b-7189-474f-9eac-0b0b75dc94e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21735", "type": "seen", "source": "https://t.me/CyberDispatch/1715", "content": "CVE-2021-21735: ZTE H168N wizard whitelist exposed PPPoE and WLAN secrets pre-auth.", "creation_timestamp": "2026-08-30T00:00:40.523864Z"}, {"uuid": "6711ec9b-e46e-4435-b907-90456c9bc1df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21735", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mmp6j7lche2v", "content": "CVE-2021-21735: ZTE H168N wizard whitelist exposed PPPoE and WLAN secrets pre-auth", "creation_timestamp": "2026-05-25T19:10:00.421943Z"}, {"uuid": "7606abcd-63c6-4e70-86ef-56e404fc14de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21735", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mmsac3s46k2g", "content": "[SECURITY ADVISORY] CVE-2021-21735 - ZTE ZXHN H168N V3.5 Unauthenticated Admin Credential Leak\n\nPosted by m.nageh on May 25-----BEGIN SECURITY ADVISORY----- \n\nAdvisory ID: MONX-2021-001 \nCVE ID: CVE-2021-21735 \nTitle: ZTE ZXHN H168N V3.5 - Unauthenticated Wizard Credential \nDisclo\u2026\n#hackernews #news", "creation_timestamp": "2026-05-27T00:19:21.549923Z"}, {"uuid": "48f3e1c0-0406-48a7-8111-91da67f4e1bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21735", "type": "seen", "source": "https://t.me/CyberDispatch/1715", "content": "CVE-2021-21735: ZTE H168N wizard whitelist exposed PPPoE and WLAN secrets pre-auth.", "creation_timestamp": "2026-08-29T20:00:14.768789Z"}, {"uuid": "0461b522-eb0c-405a-a288-90a00e6fce25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-21735", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmve6uvzr325", "content": "\ud83d\udccc CVE-2021-21735: ZTE H168N Router Vulnerability Exposes PPPoE and WLAN Secrets https://www.cyberhub.blog/article/26416-cve-2021-21735-zte-h168n-router-vulnerability-exposes-pppoe-and-wlan-secrets", "creation_timestamp": "2026-05-28T06:07:07.510424Z"}, {"uuid": "02f92e9f-40ab-4e33-815e-fce5cc90e607", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-21735", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mmvypdoxnc2c", "content": "Source & attribution. This is an original English rewrite of the writeup \u201cUnauthenticated Information Leak to Full Admin Compromise on ZTE ZXHN H168N (CVE-2021-21735)\u201d by Mina Zekry, published at minanagehsalalma.github.io.\nhttps://core-jmp.org/2026/05/zte-zxhn-h168n-cve-2021-21735-admin-compromise/", "creation_timestamp": "2026-05-28T12:14:15.302191Z"}, {"uuid": "5878114a-2254-465d-a1d5-7421e86bf27d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-21735", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/116715069836205793", "content": "https://github.com/Hunt-Benito/mediatek-wlan-heap-overflow-cve-2026-20452-filogic-router-rce\nhttps://github.com/iwallplace/CVE-2026-26898-Xiaomi-SSRF-HostHeaderInjection\nhttps://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router\nhttps://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure\nhttps://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers\nhttps://github.com/minanagehsalalma/cve-2021-21735-zte-zxhn-h168n-admin-compromise\n#internetOfShit", "creation_timestamp": "2026-06-08T14:57:20.767566Z"}, {"uuid": "9408d5c5-7c1b-4ba1-8771-e1667d26e24a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21735", "type": "seen", "source": "https://t.me/CyberDispatch/1715", "content": "CVE-2021-21735: ZTE H168N wizard whitelist exposed PPPoE and WLAN secrets pre-auth.", "creation_timestamp": "2026-08-31T00:00:38.155315Z"}, {"uuid": "d791a406-7515-4acb-ade7-71703f76e8bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21735", "type": "seen", "source": "https://t.me/hacking_Attack/186047", "content": "CVE-2021-21735 is a good reminder that router testing should not stop at the login page. On the ZTE ZXHN H168N V3.5, setup/wizard handlers exposed PPPoE and WLAN material through routes that should have stayed behind an authenticated configuration boundary. The interesting part was not a default password or brute force path. It was setup logic being trusted too much. The write-up focuses on what to test in embedded web interfaces: onboarding routes, wizard handlers, hidden config endpoints, password-return actions, and firmware-side route allowlists.    submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://minanagehsalalma.github.io/cve-2021-21735-zte-zxhn-h168n-admin-compromise/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1tnc5cg/why_router_setup_wizards_pages_are_the_trickiest/)", "creation_timestamp": "2026-09-01T20:00:10.291448Z"}, {"uuid": "90907f44-09f2-47d4-9e94-b2d03d9d143a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21735", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/186047", "content": "CVE-2021-21735 is a good reminder that router testing should not stop at the login page. On the ZTE ZXHN H168N V3.5, setup/wizard handlers exposed PPPoE and WLAN material through routes that should have stayed behind an authenticated configuration boundary. The interesting part was not a default password or brute force path. It was setup logic being trusted too much. The write-up focuses on what to test in embedded web interfaces: onboarding routes, wizard handlers, hidden config endpoints, password-return actions, and firmware-side route allowlists.    submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://minanagehsalalma.github.io/cve-2021-21735-zte-zxhn-h168n-admin-compromise/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1tnc5cg/why_router_setup_wizards_pages_are_the_trickiest/)", "creation_timestamp": "2026-09-02T01:00:19.893807Z"}]}