Vulnerability Report

CVE-2026-34472

Title: Unauthenticated Credential Disclosure in ZTE ZXHN H188A

Information Disclosure

Proof Of Concept

PoC Available for CVE-2026-34472

CWE Category CWE-200

Published Date Mar 30, 2026

Modified Date May 26, 2026

Exploit Status Available

Score 7.1 CVSS v3.1

Exploit Probability (EPSS)

1.98%

Vulnerability Summary

CVE-2026-34472: Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK, and PPPoE credentials. In some observed cases, configuration changes may also be performed without authentication.

Impacted Vendors

zte 1

Reference Links

https://gist.github.com/minanagehsalalma/7a8516b9b00d0008f2f25750320560c9 https://www.zte.com.cn/global/

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity HIGH

7.1

Attack Vector

ADJACENT_NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-34472 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router

View Code

Exploit-DB https://www.exploit-db.com/exploits/52593

View Code

May 26, 2026 MODIFIED