What is the CVSS score of CVE-2026-49008?

CVE-2026-49008 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-49008?

Yes, a public proof-of-concept exploit is available for CVE-2026-49008. Prioritise patching immediately. EPSS: 0.2%.

ZTE ZXHN F680 CVE-2026-49008

EUVD-2026-54410 MEDIUM

Use of Hard-coded Cryptographic Key (CWE-321)

2026-08-07 zte

GHSA-p494-g4pp-qhm5

Information Disclosure Zte F689

6.5

CVSS 3.1 · Vendor: zte

Severity by source

Vendor (zte) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.1 HIGH

PR:L confirmed by vendor vector; C:L added because credential extraction constitutes a confidentiality impact the vendor's C:N omits; I:H retained for integrity bypass consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (zte).

CVSS VectorVendor: zte

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 09:22 vuln.today

DescriptionCVE.org

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.

AnalysisAI

Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenticated network attacker to extract integrity verification keys and subsequently bypass application integrity checks on the device. Seven specific firmware versions across the V9.0.10 P1, P4, and P6 branches are confirmed affected per the ZTE advisory. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-321 (Use of Hard-coded Cryptographic Key) identifies the root cause: cryptographic credentials used to verify the integrity of a specific device application function are stored statically in unencrypted firmware. Because these keys are hardcoded rather than device-unique, extracting them from one ZXHN F680 unit yields keys valid across all units running the same firmware build. The CPE cpe:2.3:a:zte:f689:*:*:*:*:*:*:*:* identifies ZTE's F689/F680 product line - an ONT (Optical Network Terminal) device used for FTTH fiber broadband connections, typically ISP-provisioned. The CVSS vector AV:N/PR:L implies the unencrypted firmware data is accessible via a network-reachable interface (e.g., the device web management portal or CLI) with low-privilege authentication, not requiring physical flash extraction.

RemediationAI

Consult the ZTE vendor advisory at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031803093 for the official firmware update. No specific patched firmware version number is confirmed in the available input data; contact your ISP or ZTE directly to obtain an updated firmware build beyond the affected V9.0.10 P1/P4/P6 releases. As a compensating control pending patching, restrict management interface access (web UI, SSH, Telnet) to trusted internal IP ranges only and disable any remote management features exposed to the WAN interface, which reduces the attack surface for the PR:L network vector. Additionally, rotate any low-privilege device credentials to non-default values, as default credentials are a common enabler for this class of attack. Be aware that restricting management access may impact ISP remote provisioning capabilities.