EUVD-2026-54357
GHSA-3vhw-pg83-cf2w
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Physical access needed to read firmware; no privileges required once device is in hand; only hash disclosed, no integrity or availability impact.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
Lifecycle Timeline
1DescriptionCVE.org
The root password hash of the device can be obtained through unencrypted information in the firmware.
AnalysisAI
Root password hash exposure in ZTE F689 firmware allows a physical attacker to extract credential material stored in cleartext or weakly protected form within the device firmware image. The F689 is an ISP-deployed broadband gateway, and this vulnerability (CWE-916) means the hash protecting root-level access uses insufficient computational effort, making offline cracking feasible once extracted. No public exploit code has been identified and no active exploitation is confirmed; however, successful hash recovery grants an attacker a path to persistent root-level device compromise.
Technical ContextAI
The affected product is the ZTE F689 broadband gateway, identified by CPE cpe:2.3:a:zte:f689:*:*:*:*:*:*:*:*. The root cause is CWE-916 (Use of Password Hash With Insufficient Computational Effort), meaning the firmware stores the root account's password hash using a weak or deprecated hashing algorithm (e.g., MD5-crypt, DES-crypt, or similar) rather than a modern key-derivation function such as bcrypt, scrypt, or Argon2. Because the firmware image itself is unencrypted, any party who can extract the firmware binary - via physical UART/JTAG access, a firmware dump from flash memory, or a publicly downloadable firmware update file - can read the hash directly and subject it to offline dictionary or brute-force attacks. The CVSS physical attack vector (AV:P) reflects the requirement for local or physical access to the device or its firmware.
RemediationAI
The primary remediation is to apply the firmware update referenced in ZTE's security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7458768768701636680; an exact patched firmware version was not independently confirmed from the available input data, so consult the advisory directly for the target version. The fix should replace the weak password hash with a modern key-derivation function (bcrypt, scrypt, or Argon2) and, ideally, encrypt or sign the firmware image to prevent trivial extraction. As a compensating control where patching is delayed, ISP operators should implement device lifecycle controls: securely wipe or re-flash devices before reuse or disposal, restrict physical access to deployed equipment, and audit whether firmware images posted publicly on support portals contain the same credential material. Changing the default root password to a high-entropy value does not eliminate the hash disclosure but raises the cost of offline cracking significantly.
Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenti
TLS credential exposure in ZTE ZXHN F680 fiber gateway firmware allows an adjacent-network attacker to extract unencrypt
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today