CVE-2025-53558: ZTE ZXHN-F660 Auth Bypass Vulnerability

CVE-2025-53558 Overview

CVE-2025-53558 affects the ZXHN-F660T and ZXHN-F660A home gateway devices distributed by ZTE Japan K.K. The devices ship with a common credential that is identical across all installations. An attacker with knowledge of the shared credential can authenticate to any affected device and gain administrative access. The weakness is classified under [CWE-1391] (Use of Weak Credentials). Exploitation requires adjacent network access, meaning the attacker must be on the same local or Wi-Fi network as the target gateway.

Critical Impact
An adjacent-network attacker who learns the shared credential can authenticate to any ZXHN-F660T or ZXHN-F660A device, compromising confidentiality, integrity, and availability of the home gateway and the traffic it routes.

Affected Products

ZTE Japan K.K. ZXHN-F660T home gateway
ZTE Japan K.K. ZXHN-F660A home gateway
Deployments using factory-shipped default credentials

Discovery Timeline

2025-07-31 - CVE-2025-53558 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53558

Vulnerability Analysis

The ZXHN-F660T and ZXHN-F660A gateways use a single credential set that is common to every installation of the affected models. Because the credential is shared across the entire product line, any party who learns it can authenticate to any device of the same model. This pattern is recognized as [CWE-1391] (Use of Weak Credentials) and is a well-known anti-pattern in embedded networking equipment. Exploitation does not require a software flaw, malformed input, or memory corruption — possession of the credential alone is sufficient. The vulnerability cannot be remediated through patching the binary code paths, since the issue is rooted in provisioning practice.

Root Cause

The root cause is the shipment of identical credentials across all units of the ZXHN-F660T and ZXHN-F660A. The devices do not enforce a first-boot credential change, and the shared secret is not unique per device or per customer. Once the credential is published, leaked, or recovered from a single unit, every deployed device of the same model becomes accessible to anyone who can reach its management interface.

Attack Vector

An attacker positioned on an adjacent network — for example, connected to the same Wi-Fi SSID or LAN segment as the target gateway — submits the known credential to the device's authentication interface. After authentication, the attacker holds the device's administrative privileges. From there, the attacker can alter routing and DNS settings, intercept or redirect traffic, expose internal services, push malicious firmware, or pivot to other devices on the LAN. See the JVN Security Advisory for vendor-coordinated details.

Detection Methods for CVE-2025-53558

Indicators of Compromise

Successful administrative logins to the gateway from unexpected LAN or Wi-Fi clients
Unexpected changes to DNS servers, DHCP options, or static routes on the gateway
New or modified port-forwarding and firewall rules that were not requested by the operator
Firmware version, configuration backups, or admin sessions originating from unknown MAC addresses

Detection Strategies

Review gateway authentication logs for logins that do not correspond to a known administrator action
Compare current device configuration against a known-good baseline and alert on drift
Monitor LAN traffic for unsolicited HTTP/HTTPS POST requests to the device management URL from non-admin hosts
Track DNS resolution behavior of client devices for signs that the gateway is forwarding to attacker-controlled resolvers

Monitoring Recommendations

Enable and centrally collect syslog from the gateway where supported by the firmware
Alert on any changes to administrative passwords, remote management settings, or WAN configuration
Watch for outbound connections from the gateway to unfamiliar hosts that may indicate command-and-control
Inventory ZXHN-F660T and ZXHN-F660A units on the network and confirm each has been re-provisioned with a unique credential

How to Mitigate CVE-2025-53558

Immediate Actions Required

Change the default administrative credential on every ZXHN-F660T and ZXHN-F660A device to a unique, strong value
Disable remote (WAN-side) management on the gateway unless explicitly required
Segment guest Wi-Fi from the management VLAN so untrusted clients cannot reach the device admin interface
Contact ZTE Japan K.K. or the service provider that supplied the device for vendor-issued remediation guidance

Patch Information

Refer to the JVN Security Advisory JVN66546573 for vendor-coordinated remediation status. Because the weakness stems from shared default credentials rather than a code defect, remediation requires either operator action to set a unique password or vendor-supplied firmware that enforces a per-device credential at first boot.

Workarounds

Restrict access to the gateway's management interface by binding it to a dedicated management VLAN
Apply firewall rules on the LAN to permit administrative TCP ports only from known administrative hosts
Rotate Wi-Fi passphrases and review the connected-client list to remove unauthorized devices
Where the device cannot be reconfigured, replace it with a model that enforces unique per-unit credentials

bash

# Configuration example: restrict gateway admin access to a single management host
# Run on an upstream firewall or managed switch ACL
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80  -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP