VulnSocial

CVE-2026-34474Disclosure

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sensitive device and account information. In affected builds, the response may include the administrator password and WLAN PSK, enabling authentication bypass and network compromise. Some firmware versions may expose only partial identifiers (e.g., serial number, ESSID, MAC addresses).

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 2 mentions (2026-05-07); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-05-07: 2Mentions · 2026-05-08: 1Mentions · 2026-05-21: 1PoC Mentioned / Linked · 2026-05-21: 1Exploit Tool / Code · 2026-05-21: 1Technical Details · 2026-05-07: 2Technical Details · 2026-05-08: 1Technical Details · 2026-05-21: 105-0705-0805-21
Signal classification2 categories
Disclosure
375.0%
PoC
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-072
Disclosure2
2026-05-081
Disclosure1
2026-05-211
PoC1
Full discourse4 posts
  • Nicolas Krassas@Dinosn
    PoC

    CVE-2026-34474: Pre-auth credential disclosure in ZTE H298A / H108N via ETHCheat https://minanagehsalalma.github.io/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure/

    Post summary

    A probe reveals CVE‑2026‑34474, a pre‑authentication credential disclosure in ZTE H298A/H108N, with a link to a site that likely hosts a proof of concept using the ETHCheat tool, but no evidence of active exploitation or patch information.

    010421.3K
    158.6K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-34474 Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sensitive … https://www.cve.org/CVERecord?id=CVE-2026-34474

    Post summary

    The entry reports a sensitive data exposure vulnerability (CVE‑2026‑34474) in ZTE routers that could leak admin/WLAN credentials via a crafted web request, with no evidence of active exploitation, PoC, or patch.

    00010349
    57.4K followersView on X
  • Mina Zekry@MonxResearch
    Disclosure

    I went digging in ZTE ZXHN routers. Found 3 CVEs. Solo. No team. 🔴 CVE-2026-34472 — credential disclosure 🔴 CVE-2026-34473 — unauth DoS, 17 models hit 🔴 CVE-2026-34474 — admin + WLAN creds in plaintext Write-up coming soon. Open to vuln research / offsec roles. DMs open.

    Post summary

    The author reports discovering three CVEs in ZTE ZXHN routers, detailing the nature of each vulnerability, but no PoC, exploit, patch, or evidence of active exploitation has been shared.

    0000092
    1 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-34474 Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sensitive … https://www.cve.org/CVERecord?id=CVE-2026-34474 ----- Traducción: CVE-2026-34474 Exp… http://infoflow.cloud`

    Post summary

    CVE-2026-34474 exposes admin/WLAN credentials on ZTE routers via crafted requests to the web interface, highlighting a sensitive data exposure vulnerability; no PoC or patch info is provided.

    00000156
    75 followersView on X

Explore more

Back to dashboard