What is the CVSS score of CVE-2026-34474?

CVE-2026-34474 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of ZTE ZXHN routers are affected by CVE-2026-34474?

CVE-2026-34474 affects ZTE ZXHN H298A and H108N routers, allowing unauthenticated remote attackers to steal administrator credentials and wireless network keys through the web management interface.

Is there a public PoC exploit available for CVE-2026-34474?

Yes, a public proof-of-concept exploit is available for CVE-2026-34474. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-34474?

Within 24 hours: Identify and inventory all ZTE ZXHN H298A (firmware 1.1) and H108N (firmware 2.6) devices on your network using asset management tools or network scanning. Within 7 days: Implement network segmentation to restrict access to router management interfaces to trusted administrative networks only; disable remote management features if not operationally required. Within 30 days: Contact ZTE for patch availability status; if firmware updates are released, apply them immediately to all affected models; if no patch materializes, evaluate replacement of these router models with equipment from vendors with active security support.

ZTE ZXHN routers CVE-2026-34474

EUVD-2026-27883 HIGH

Information Exposure (CWE-200)

2026-05-06 mitre

Authentication Bypass Zte Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 13:22 vuln.today

CVSS changed

May 07, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

May 06, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sensitive device and account information. In affected builds, the response may include the administrator password and WLAN PSK, enabling authentication bypass and network compromise. Some firmware versions may expose only partial identifiers (e.g., serial number, ESSID, MAC addresses).

AnalysisAI

Remote unauthenticated attackers can retrieve plaintext administrator passwords and WLAN Pre-Shared Keys from ZTE ZXHN H298A (firmware 1.1) and H108N (firmware 2.6) routers via crafted HTTP requests to the web management interface. The vulnerability enables complete network compromise through credential theft without requiring authentication. Public exploit code exists (GitHub Gist), demonstrating active researcher interest, though no CISA KEV listing indicates targeted rather than widespread exploitation. EPSS data unavailable, but the combination of network attack vector, no authentication requirement, and credential exposure presents immediate risk to affected deployments.

Technical ContextAI

This is an information disclosure vulnerability (CWE-200) in ZTE's embedded web server implementation for consumer-grade ZXHN router series. The web management interface fails to implement proper authentication checks or output sanitization on specific endpoints, allowing unauthenticated HTTP requests to trigger responses containing sensitive configuration data. Affected models are home/SOHO gateway devices combining routing, wireless access point, and management functions. The vulnerability exposes data from the device's configuration store or memory, which contains plaintext or weakly-protected credentials. The CVSS vector confirms network-accessible exploitation requiring no special conditions (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact but no integrity or availability impact, consistent with pure data exfiltration.

RemediationAI

Contact ZTE technical support or check the official ZTE security portal (https://www.zte.com.cn/global/) for firmware updates addressing this vulnerability. No specific patched firmware version has been independently confirmed in available references, requiring direct vendor contact for remediation guidance. If firmware updates are unavailable or cannot be immediately deployed, implement these compensating controls: (1) Disable remote/WAN-side management access to the router web interface, restricting access to LAN-side only (trade-off: remote administration unavailable), (2) Change default administrator credentials and WLAN PSK immediately to limit damage if already compromised, (3) Implement network segmentation isolating the router management interface from untrusted networks using firewall rules or VLANs (trade-off: increased configuration complexity), (4) Deploy network monitoring to detect unusual access patterns to router management ports (TCP 80/443/8080). For enterprise deployments, consider replacing affected devices with alternative hardware if vendor support is inadequate. The GitHub Gist at https://gist.github.com/minanagehsalalma/7a8516b9b00d0008f2f25750320560c9 documents the vulnerability but does not provide remediation guidance.