CVEvulnerability

CVE-2026-34472

7.1 HIGH Published 2026-03-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2026-03-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.1 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-200, CWE-306

Description

Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK, and PPPoE credentials. In some observed cases, configuration changes may also be performed without authentication.

Affected configurations

• zte zxhn h188a firmware 6.0.10p2 te • zte zxhn h188a firmware 6.0.10p3n3 te

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References