CVE-2026-34474: ZTE Router Information Disclosure Flaw

CVE-2026-34474 Overview

CVE-2026-34474 is a sensitive information disclosure vulnerability affecting ZTE ZXHN H298A 1.1 and H108N 2.6 routers. A crafted request to the router web interface returns sensitive device and account data in the response. Affected builds may include the administrator password and the Wireless Local Area Network (WLAN) Pre-Shared Key (PSK) in this output. Some firmware versions return only partial identifiers such as serial number, Extended Service Set Identifier (ESSID), and Media Access Control (MAC) addresses. The flaw maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact

An unauthenticated network-adjacent attacker can retrieve administrator credentials and the WLAN PSK, enabling full router takeover and access to the local wireless network.

Affected Products

• ZTE ZXHN H298A version 1.1
• ZTE ZXHN H108N version 2.6
• Additional firmware builds that expose partial identifiers through the same endpoint

Discovery Timeline

• 2026-05-06 - CVE-2026-34474 published to the National Vulnerability Database (NVD)
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-34474

Vulnerability Analysis

The vulnerability resides in the web management interface of the affected ZTE customer-premises equipment. A crafted Hypertext Transfer Protocol (HTTP) request to the router exposes configuration data without proper authentication or output filtering. The response body returns provisioning fields that should be restricted to authenticated administrators.

In the most severe configurations, the leaked payload contains the device administrator password in cleartext alongside the WLAN PSK. An attacker on the same network segment, or any network path that reaches the management interface, can capture both values in a single request. With these credentials, the attacker logs in to the router, modifies routing and Domain Name System (DNS) settings, and joins the wireless network as a trusted client.

Root Cause

The firmware exposes an information endpoint that aggregates device state for diagnostic or provisioning purposes. The handler does not enforce authentication, does not filter secret material from the serialized output, and treats the response as non-sensitive. This is a classic [CWE-200] design flaw: secrets are placed in the same data structure as benign metadata and returned together.

Attack Vector

Exploitation requires only network reachability to the router web interface. No user interaction and no prior credentials are needed. The attacker issues a single crafted request, parses the response, and extracts the administrator password and WLAN PSK fields. A proof-of-concept demonstrating the request and parsing logic is published in the GitHub Gist PoC Repository.

No verified exploitation code is reproduced here. Refer to the linked gist for the request format and field mapping.

Detection Methods for CVE-2026-34474

Indicators of Compromise

• Unexpected HTTP GET or POST requests to diagnostic or configuration endpoints on the router management interface from non-administrative hosts.
• Outbound connections from the router to unfamiliar destinations following a configuration query, indicating possible post-exploitation use of leaked credentials.
• New or unrecognized clients associating with the WLAN using the correct PSK shortly after a query to the router web interface.
• Administrator login events from new source addresses without a corresponding password reset.

Detection Strategies

• Inspect router access logs for unauthenticated requests that return large response bodies from configuration endpoints.
• Correlate HTTP requests to the router with subsequent administrator authentication events from the same source IP.
• Monitor for repeated probing of the router management interface from internal hosts that do not normally administer network equipment.

Monitoring Recommendations

• Forward router syslog and HTTP access logs to a central logging platform for retention and correlation.
• Alert on any administrative configuration change on affected ZTE models until firmware is updated.
• Track new WLAN client associations and flag devices with MAC addresses that do not match the inventory of known endpoints.

How to Mitigate CVE-2026-34474

Immediate Actions Required

• Restrict access to the router web interface to trusted management Virtual Local Area Networks (VLANs) and block it from the wide-area network (WAN) side.
• Rotate the router administrator password and the WLAN PSK on all affected ZXHN H298A 1.1 and H108N 2.6 devices.
• Disable remote management features that expose the web interface beyond the local network.
• Review router configuration for unauthorized changes to DNS servers, port forwarding rules, and administrative accounts.

Patch Information

No vendor advisory URL is listed in the NVD record at the time of publication. Operators should consult the ZTE Global Corporate Website and contact their service provider for firmware updates that address CVE-2026-34474. Replace end-of-life devices that no longer receive security firmware.

Workarounds

• Place affected routers behind a network access control list that limits HTTP and HTTPS access to a dedicated management host.
• Segment guest and Internet of Things (IoT) traffic onto a separate Service Set Identifier (SSID) so that PSK exposure does not grant access to internal resources.
• Where the device supports it, disable the diagnostic or information endpoint exercised by the proof of concept until a patched firmware is available.
• For service providers, push a configuration profile that enforces strong, unique administrator and WLAN credentials on each customer device.

# Example: restrict router web interface to a single management host on a Linux gateway
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80  -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP