ZTE H-series router web interface oversized POST unauthenticated denial of service

#!/usr/bin/env python3
# CVE-2026-34473 non-destructive exposure/fingerprint check
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import re
import sys
from urllib.parse import urljoin

try:
    import requests
    requests.packages.urllib3.disable_warnings()  # type: ignore[attr-defined]
except Exception:
    print('UNKNOWN')
    sys.exit(2)

AFFECTED_MODELS = {
    'H8102E','H168N','H167A','H199A','H288A','H198A','H267A','H267N',
    'H268A','H388X','H196A','H369A','H268N','H208N','H367N','H181A','H196Q'
}

BUILD_YEAR_RE = re.compile(r'(20\d{2})')
MODEL_RE = re.compile(r'\b(H8102E|H168N|H167A|H199A|H288A|H198A|H267A|H267N|H268A|H388X|H196A|H369A|H268N|H208N|H367N|H181A|H196Q)\b', re.I)
FIRMWARE_RE = re.compile(r'(firmware|software|version|build)[^\n<]{0,80}', re.I)


def fetch_text(base_url):
    paths = ['/', '/cgi-bin/luci', '/index.html', '/login.html']
    session = requests.Session()
    session.headers.update({'User-Agent': 'noisgate-cve-check/1.0'})
    blobs = []
    for p in paths:
        url = urljoin(base_url.rstrip('/') + '/', p.lstrip('/'))
        try:
            r = session.get(url, timeout=8, verify=False, allow_redirects=True)
            if r.text:
                blobs.append(r.text[:200000])
            for k, v in r.headers.items():
                blobs.append(f'{k}: {v}')
        except Exception:
            continue
    return '\n'.join(blobs)


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN')
        sys.exit(2)

    base = sys.argv[1]
    if not re.match(r'^https?://', base, re.I):
        print('UNKNOWN')
        sys.exit(2)

    text = fetch_text(base)
    if not text.strip():
        print('UNKNOWN')
        sys.exit(2)

    upper = text.upper()
    model_hits = {m.upper() for m in MODEL_RE.findall(upper)}
    zteish = ('ZTE' in upper) or ('ZXHN' in upper) or bool(model_hits)

    if not zteish:
        print('UNKNOWN')
        sys.exit(2)

    if not model_hits:
        # Looks like ZTE/ZXHN but model is not visible unauthenticated.
        print('UNKNOWN')
        sys.exit(2)

    affected = any(m in AFFECTED_MODELS for m in model_hits)
    if not affected:
        print('PATCHED')
        sys.exit(0)

    # Try to infer build age from exposed strings.
    context = ' '.join(FIRMWARE_RE.findall(text))
    years = [int(y) for y in BUILD_YEAR_RE.findall(text) if 2000 <= int(y) <= 2099]
    year = min(years) if years else None

    # Heuristic only:
    # - If an affected model is identified and any visible build marker is pre-2022, call VULNERABLE.
    # - If an affected model is identified and all visible build markers are >=2022, call PATCHED.
    # - Otherwise UNKNOWN.
    if year is not None and year < 2022:
        print('VULNERABLE')
        sys.exit(1)
    if year is not None and year >= 2022:
        print('PATCHED')
        sys.exit(0)

    print('UNKNOWN')
    sys.exit(2)


if __name__ == '__main__':
    main()