PT-2026-38217 · Undefined · Undefined

Minanagehsalalma · Published 2026-05-06 · Updated 2026-05-31 · CVE-2026-34473

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ZTE H8102E (affected versions not specified) ZTE H168N (affected versions not specified) ZTE H167A (affected versions not specified) ZTE H199A (affected versions not specified) ZTE H288A (affected versions not specified) ZTE H198A (affected versions not specified) ZTE H267A (affected versions not specified) ZTE H267N (affected versions not specified) ZTE H268A (affected versions not specified) ZTE H388X (affected versions not specified) ZTE H196A (affected versions not specified) ZTE H369A (affected versions not specified) ZTE H268N (affected versions not specified) ZTE H208N (affected versions not specified) ZTE H367N (affected versions not specified) ZTE H181A (affected versions not specified) ZTE H196Q (affected versions not specified)

Description An unauthenticated denial-of-service condition exists in the web interface of several router models. The issue occurs because the CGILua parser (a component that processes Common Gateway Interface requests using the Lua programming language) eagerly reads and processes request bodies before authentication. An attacker can trigger this by sending an oversized application/x-www-form-urlencoded POST body, which may cause the management interface to become unresponsive until the device is rebooted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-34473

Affected Products

Undefined

References · 12

• 🔥 https://exploit-db.com/exploits/52594 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34473 · Security Note
• https://zte.com.cn/global · Note
• https://t.me/secharvester/22522 · Telegram Post
• https://t.me/RNetsec/23151 · Telegram Post
• https://twitter.com/redsecuretech/status/2061121948805992673 · Twitter Post
• https://i.redd.it/u38hzewup22h1.gif · Reddit Post
• https://gist.github.com/minanagehsalalma/7a8516b9b00d0008f2f25750320560c9 · Note
• https://t.me/defcon_news/135797 · Telegram Post
• http://seclists.org/fulldisclosure/2026/May/18 · Note
• https://twitter.com/MonxResearch/status/2052849142330786125 · Twitter Post
• https://minanagehsalalma.github.io/cve-2026-34473-unauthenticated-dos-zte-routers · Reddit Post