CVE-2026-34472

State: Published
Severity: 7.1 High
Published: Mar 30, 2026
Updated: May 26, 2026
Reserved: Mar 27, 2026

Description

Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK, and PPPoE credentials. In some observed cases, configuration changes may also be performed without authentication.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	CISA-ADP

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
n/an/a	n/aAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.