A vulnerability in the ZTE ZXHN H188A V6 router allows an unauthenticated attacker to grab the admin password and Wi-Fi PSK without ever logging in. It’s CVE-2026-34472, and it’s about as bad as router bugs get.
The root cause is in router_logic_impl.lua, which accepts certain URL parameters directly from unauthenticated requests. A crafted request triggers wizard handler endpoints that expose credential-bearing actions — getPassword, wlan_get, ppp_get — to anyone who asks.
Here’s the kicker: the Wi-Fi password is also the default admin password, just uppercased. So an attacker who pulls the PSK gets full administrative access to the router. Game over in one request.
Researcher Mina Nageh Salalma from Monx Research reported this through proper channels. When ZTE’s PSIRT stopped responding, MITRE assigned the CVE after escalation on March 2726. At the time of the original research in May 2024, around 500 H188A interfaces were publicly reachable.
The affected firmware versions are V6.0.10P2_TE and V6.0.10P3N3_TE. ISPs using these routers should push patches quickly — if they push them at all. Home users with this hardware should check the admin panel for any signs of unauthorized access and rotate both the Wi-Fi and admin passwords as a precaution.
Router bugs like this are genuinely dangerous because most people never update their firmware and ISPs rarely push timely updates. A single unauthenticated request yielding admin credentials is about as critical as it gets in embedded device security.
