EUVD-2026-17107Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to local network
-
ExploitAccess wizard interface unauthenticated
-
ExecutionRetrieve stored credentials from web interface
-
ImpactObtain admin password and WLAN PSK
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be on the local network (AV:A). Affects ZTE ZXHN H188A firmware versions V6.0.10P2_TE and V6.0.10P3N3_TE. No authentication required to access the wizard interface and retrieve stored credentials (default admin password, WLAN PSK, PPPoE credentials) from the web management interface. |
| Impact | The risk profile is difficult to quantify precisely due to the absence of CVSS, EPSS, and KEV metadata. However, several factors elevate operational risk: (1) Credential disclosure includes default administrator passwords and wireless network pre-shared keys (WLAN PSK), enabling full device takeover and wireless network compromise; (2) the local network constraint significantly reduces immediate exposure compared to remotely exploitable vulnerabilities, limiting the attacker population to devices already on the LAN; (3) residential routers are rarely segmented from user devices, making credential theft directly actionable by any connected device; (4) the existence of a public technical analysis (GitHub gist) suggests proof-of-concept code or detailed exploitation steps are available, lowering the barrier to exploitation; (5) ZTE equipment is widely deployed in developing markets, potentially affecting thousands of installations. The unauthenticated nature combined with credential exposure makes this a high-priority issue for affected deployments, despite the local network requirement. |
| Exploit ScenarioDerived | An attacker with access to the local network (e.g., a guest on a home WiFi network or a compromised device on the same LAN) navigates to the router's web management interface on the default IP address (typically 192.168.1.1) and accesses the wizard interface without authentication. The attacker retrieves the administrator password, WLAN PSK, and PPPoE credentials by either reading them directly from wizard pages or extracting them from unencrypted HTTP responses. With these credentials, the attacker gains full control of the router, modifying DNS settings, enabling remote management, or altering wireless settings. Publicly available technical guidance (per the GitHub reference) provides step-by-step exploitation methodology, reducing the skill barrier for execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 30, 2026
Unauthenticated credential disclosure in ZTE ZXHN H188A routers (versions V6.0.10P2_TE and V6.0.10P3N3_TE) allows local network attackers to retrieve sensitive credentials including default administrator passwords, WLAN PSK, and PPPoE credentials via the wizard interface, with some cases enabling unauthenticated configuration changes. No CVSS or EPSS data is available, and KEV status is unconfirmed; however, a publicly available technical analysis exists on GitHub indicating detailed exploitation methodology.
RemediationAI
Contact ZTE support or visit the ZTE global support portal (https://www.zte.com.cn/global/) to obtain a firmware update for the ZXHN H188A router. Confirm availability of patched firmware versions beyond V6.0.10P2_TE and V6.0.10P3N3_TE. As an interim mitigation, disable remote management of the router's web interface (if enabled), restrict access to the router's LAN subnet to authorized devices only, change default administrator credentials immediately after device provisioning, and implement network-level access controls (MAC filtering or VLAN isolation) to limit which devices can communicate with the router's management interface. The technical analysis available at https://gist.github.com/minanagehsalalma/7a8516b9b00d0008f2f25750320560c9 should be reviewed to understand the specific attack surface and apply targeted controls.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the web management wizard interface of ZTE ZXHN H188A residential broadband routers. The affected versions (V6.0.10P2_TE and V6.0.10P3N3_TE) contain an authentication bypass or inadequate access control mechanism in the wizard functionality that allows unauthenticated users on the local network to interact with the router's configuration interface. This is an information disclosure vulnerability with potential for unauthorized modification of router settings. The attack vector is network-based but limited to the local network (LAN) rather than remotely accessible over the internet, which constrains the attack surface to devices connected to the same network segment.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK, and PPPoE credentials. In some observed cases, configuration changes may also be performed without authentication.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali