EUVD-2026-54396
GHSA-2987-f3mh-x43q
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Adjacent network required to obtain firmware image; AC:H reflects non-trivial extraction and parsing steps; no authentication needed; only confidentiality of TLS credentials is impacted.
Primary rating from Vendor (zte).
CVSS VectorVendor: zte
Lifecycle Timeline
1DescriptionCVE.org
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.
AnalysisAI
TLS credential exposure in ZTE ZXHN F680 fiber gateway firmware allows an adjacent-network attacker to extract unencrypted cryptographic key material - classified under CWE-321 (Use of Hard-coded Cryptographic Key) - enabling potential decryption or impersonation of TLS-protected communications between the device and upstream ISP services. Seven discrete firmware versions are confirmed affected per the ENISA EUVD entry and ZTE's own advisory. No public exploit code or CISA KEV listing is confirmed at time of analysis, and the CVSS adjacency requirement and high complexity rating limit realistic exploitation to technically capable actors with local network proximity.
Technical ContextAI
The ZTE ZXHN F680 is a fiber-to-the-home (FTTH) optical network terminal (ONT) and home gateway device widely deployed by ISPs. CPE cpe:2.3:a:zte:f689:*:*:*:*:*:*:*:* identifies the affected product family (a naming discrepancy exists between the CPE designator 'f689' and the version strings 'ZXHN F680' - these likely refer to the same product line under different naming conventions). CWE-321 (Use of Hard-coded Cryptographic Key) indicates the root cause: the firmware embeds TLS credentials - such as a private key or pre-shared key - in plaintext or otherwise unprotected form within the firmware image. This is a systemic embedded/IoT firmware design flaw where credentials are baked into the binary rather than generated per-device or protected at rest. An attacker who obtains the firmware image can parse it statically to recover the TLS key material without needing to interact with a running device.
RemediationAI
The primary remediation is to upgrade the ZTE ZXHN F680 to a firmware version that addresses this credential storage flaw. No explicit patched version number is provided in the available intelligence; consult ZTE's advisory directly at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460175237240021109 or contact your ISP, as ONT firmware is typically delivered via ISP-managed update channels rather than end-user self-service. As a compensating control where firmware update cannot be immediately applied, restrict management interface access to a dedicated out-of-band VLAN and deny general LAN access to the device's administration plane, reducing the surface available to adjacent-network attackers. Monitor for anomalous TLS certificate usage that may indicate the extracted credentials are being leveraged for device impersonation. Note that network segmentation does not remediate the underlying plaintext credential storage - it only raises the bar for an attacker to reach the firmware; the credential material remains at risk until the firmware is replaced.
Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenti
Root password hash exposure in ZTE F689 firmware allows a physical attacker to extract credential material stored in cle
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today