ZTE ZXHN H188A Unauthenticated Credential Disclosure Vulnerability

A vulnerability allowing unauthenticated credential disclosure has been identified in the ZTE ZXHN H188A router, specifically in versions V6.0.10P2_TE and V6.0.10P3N3_TE. This vulnerability exists in the wizard interface, where unauthenticated attackers on the local network can access sensitive credentials through the router's web management interface. The exposed credentials include the default administrator password, WLAN pre-shared key, and PPPoE credentials. In some cases, it was also observed that configuration changes could be made without authentication.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive credentials, including administrative and Wi-Fi-related secrets, and in some cases, allows for unauthorized configuration changes. This could result in an authentication bypass and privilege escalation, granting an attacker administrative access on the device.