PT-2021-14746 · Zte · Zxhn H168N

Published 2021-06-10 · Updated 2026-05-28 · CVE-2021-21735

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZXHN H168N versions prior to V3.5.0 EG1T4 TE

Description An information leak exists due to improper permission settings. An attacker with ordinary user permissions can obtain sensitive user information, specifically PPPoE and WLAN secrets, without authentication. This occurs because endpoints under '/wizard page/' use a brittle whitelist decision, leading to route misclassification in the firmware and secret exposure through setup handlers. In some deployments, this leaked subscriber data can be used to gain administrator access and compromise wireless security. Additionally, this can be part of a browser-delivered chain where a victim is lured through a rogue access point or captive portal to exfiltrate the Wi-Fi passphrase.

Recommendations Update to a version later than V3.5.0 EG1T4 TE. As a temporary workaround, restrict access to the '/wizard page/' endpoints to minimize the risk of exploitation.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2021-21735

Affected Products

Zxhn H168N

References · 11

• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21735 · Security Note
• https://twitter.com/ksg93rd/status/2059269578182549651 · Twitter Post
• https://twitter.com/Dinosn/status/2058956897261121715 · Twitter Post
• http://seclists.org/fulldisclosure/2026/May/21 · Note
• https://t.me/proxy_bar/3424 · Telegram Post
• https://t.me/RNetsec/23185 · Telegram Post
• https://t.me/secharvester/22599 · Telegram Post
• https://t.me/defcon_news/135934 · Telegram Post
• https://t.me/cvenotify/16075 · Telegram Post