PT-2026-38218 · Zte · H108N+1

Minanagehsalalma · Published 2026-05-06 · Updated 2026-05-21 · CVE-2026-34474

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H298A version 1.1 ZTE H108N version 2.6

Description A crafted request to the router web interface can cause sensitive data exposure. This issue may leak device and account information, including the administrator password and WLAN Pre-Shared Key (PSK), which can lead to authentication bypass and network compromise. In some firmware versions, the exposure may be limited to partial identifiers such as the serial number, ESSID, and MAC addresses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-34474

Affected Products

H108N

Zxhn H298A

References · 13

• 🔥 https://exploit-db.com/exploits/52592 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34474 · Security Note
• https://gist.github.com/minanagehsalalma/7a8516b9b00d0008f2f25750320560c9 · Note
• https://twitter.com/CVEnew/status/2052430170540118360 · Twitter Post
• https://zte.com.cn/global · Note
• https://t.me/secharvester/22557 · Telegram Post
• http://seclists.org/fulldisclosure/2026/May/20 · Note
• https://t.me/defcon_news/135856 · Telegram Post
• https://t.me/RNetsec/23167 · Telegram Post
• https://minanagehsalalma.github.io/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure · Reddit Post
• https://t.me/cveNotify/162524 · Telegram Post
• https://twitter.com/MonxResearch/status/2052849142330786125 · Twitter Post
• https://twitter.com/infoflowcloud/status/2052431220546343417 · Twitter Post