PT-2026-38217 · Zte · H208N+16

Minanagehsalalma · CVE-2026-34473 · Published 2024-05-02 · Updated 2026-05-31

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ZTE H8102E (affected versions not specified) ZTE H168N (affected versions not specified) ZTE H167A (affected versions not specified) ZTE H199A (affected versions not specified) ZTE H288A (affected versions not specified) ZTE H198A (affected versions not specified) ZTE H267A (affected versions not specified) ZTE H267N (affected versions not specified) ZTE H268A (affected versions not specified) ZTE H388X (affected versions not specified) ZTE H196A (affected versions not specified) ZTE H369A (affected versions not specified) ZTE H268N (affected versions not specified) ZTE H208N (affected versions not specified) ZTE H367N (affected versions not specified) ZTE H181A (affected versions not specified) ZTE H196Q (affected versions not specified)

Description An unauthenticated denial-of-service condition exists in the web interface of several router models. The issue occurs because the CGILua parser (a component that processes Common Gateway Interface requests using the Lua programming language) eagerly reads and processes request bodies before authentication. An attacker can trigger this by sending an oversized application/x-www-form-urlencoded POST body, which may cause the management interface to become unresponsive until the device is rebooted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2026-09682

CVE-2026-34473

Affected Products

H167A

H168N

H181A

H196A

H196Q

H198A

H199A

H208N

H267A

H267N

H268A

H268N

H288A

H367N

H369A

H388X

H8102E

References · 14

• 🔥 https://exploit-db.com/exploits/52594 · Exploit
• https://bdu.fstec.ru/vul/2026-09682 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34473 · Security Note
• http://seclists.org/fulldisclosure/2026/May/18 · Note
• https://twitter.com/redsecuretech/status/2061121948805992673 · Twitter Post
• https://t.me/secharvester/22522 · Telegram Post
• https://t.me/defcon_news/135797 · Telegram Post
• https://i.redd.it/u38hzewup22h1.gif · Reddit Post
• https://zte.com.cn/global · Note
• https://t.me/RNetsec/23151 · Telegram Post
• https://minanagehsalalma.github.io/cve-2026-34473-unauthenticated-dos-zte-routers · Reddit Post
• https://minanagehsalalma.github.io/cve-2026-34473-unauthenticated-dos-zte-routers/?trk=public_post_comment-text · Note
• https://gist.github.com/minanagehsalalma/7a8516b9b00d0008f2f25750320560c9 · Note
• https://twitter.com/MonxResearch/status/2052849142330786125 · Twitter Post