A security researcher has disclosed a vulnerability in over 17 ZTE router models that allows an attacker to crash or completely freeze the device’s web interface — no login or credentials needed.
The flaw, tracked as CVE-2026-34473, sits in the CGILua post.lua parser. It doesn’t enforce a maximum body size for form-encoded POST requests. That means a single oversized POST request sent to any CGI endpoint is enough to knock the router’s web service offline.
Mina Nageh Salalma from Monx Research discovered the issue and estimates that over 140,000 ZTE devices were publicly exposed online at the time of disclosure. The routers are deployed by ISPs worldwide, which means a lot of home and small office networks could be affected.
The attack is about as simple as it gets. There’s no authentication required — not a session cookie, not a token, nothing. The attacker just fires off a large POST body and the device’s web server stops responding. It’s the kind of bug that can be weaponized into a mass disruption weapon with minimal effort.
What makes this worse is that many ISP-provided routers don’t get patched quickly, if at all. Users often can’t update firmware themselves since the ISP controls it. If your ZTE router is exposed to the internet, it might be worth checking with your provider about patch availability.
Whitehat researchers and bug bounty folks should keep this one on the radar. Mass-impact unauthenticated DoS bugs on consumer hardware don’t come around every day.
