📄 ZTE ZXHN H188A V6 Authentication Bypass

-----BEGIN SECURITY ADVISORY-----
    
    Advisory ID:    MONX-2026-002
    CVE ID:         CVE-2026-34472
    Title:          ZTE ZXHN H188A V6 - Authentication Bypass via Pre-Login
    Wizard Credential Leakage
    Affected:       ZTE ZXHN H188A V6.0.10P2_TE, V6.0.10P3N3_TE
    Date:           2026-05-20
    Author:         Mina Nageh Salalma (Monx Research)
    Contact:        [email protected]
    Public URL:
    https://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router
    MITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34472
    
    
    VULNERABILITY DESCRIPTION
    --------------------------
    Unauthenticated requests to the root path of ZTE ZXHN H188A V6 firmware can
    reach pre-login wizard handlers and disclose WLAN PSKs, SSIDs, and PPPoE
    usernames. The leaked Wi-Fi password is also the default administrator
    password after uppercasing, resulting in full authentication bypass.
    
    
    ROOT CAUSE
    ----------
    router_logic_impl.lua accepts attacker-controlled _type and _tag parameters
    for empty-path requests. urlpath_2type_modifier.lua only activates the
    QuickSetupEnable gate when _type is absent. Supplying _type explicitly
    causes
    the wizard handlers (getPassword, wlan_get, ppp_get) to execute for
    unauthenticated requests, returning WLAN PSKs, SSIDs, and PPPoE credentials.
    
    
    TIMELINE
    --------
    2024-04-26: Local validation and PoC artifacts created.
    2024-05:    Report sent to ZTE PSIRT.
    2024-05-10: ZTE PSIRT stopped responding.
    2026-01-17: Escalated to MITRE.
    2026-02-02: ZTE PSIRT explicitly declined CVE assignment.
    2026-03-27: MITRE assigned CVE-2026-34472.
    2026-05-20: Full public disclosure.
    
    
    CREDITS
    -------
    Mina Nageh Salalma (Monx Research)
    https://github.com/minanagehsalalma
    
    -----END SECURITY ADVISORY-----