Two more ZTE router models have serious unauthenticated vulnerabilities. The H298A and H108N expose the live administrator password, Wi-Fi PSK, ESSID, and even the device serial number — all through a simple HTTP GET request.
Tracked as CVE-2026-34474, the bug lives in a Lua endpoint at /getpage.lua. A single request with a specific parameter (ETHCheat=1) makes the router return HTML containing the admin password, wireless pre-shared key, network name, and serial number in cleartext. No auth, cookies, or sessions required.
This is the third ZTE router vulnerability disclosed by researcher Mina Nageh Salalma of Monx Research, who has been methodically working through ZTE’s router firmware. The pattern is worrying: authentication bypass, denial of service, and now credential exposure — all unauthenticated, all on different ZTE models.
The affected firmware versions are ZXHN H298A 1.1 and ZXHN H108N 2.6. ZTE’s PSIRT was unresponsive during the initial reporting process, which forced the researcher to escalate to MITRE directly — a sign that the vendor’s security coordination may need work.
If you’re running one of these models, check whether your device’s management interface is exposed to the internet. If it is, treat it as compromised until proven otherwise. Change all passwords, check for unauthorized configuration changes, and push your ISP for a firmware update.
These kinds of high-impact bugs on ISP-distributed hardware are a systemic problem. Users can’t patch what they don’t control.
