CVE-2026-34472

Katalog CVE

CVSS 7.1 · High EPSS 2,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada zte zxhn h188a firmware. Skor CVSS 3.1 7.1 (High) menurut CISA ADP.

Deskripsi (NVD)

Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK, and PPPoE credentials. In some observed cases, configuration changes may also be performed without authentication.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber CISA ADP
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/minanagehsalalma/7a8516b9b00d0008f2f25750320560c9 advisory pihak ketiga
• https://www.zte.com.cn/global/ product
• http://seclists.org/fulldisclosure/2026/May/19