{“lastseen”:”2026-05-26T15:59:59″,”description”:”A single unauthenticated HTTP GET to \/getpage.lua?pid=1000\\u0026ETHCheat=1 on ZTE H298A or H108N routers returns the live administrator password OBJUSERINFOIDPassword1, WLAN PSK WLANPSKKeyPassphrase1, and SSID in plaintext HTML. A second endpoint exposes…”,”published”:”2026-05-26T00:00:00″,”modified”:”2026-05-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ZTE ZXHN H298A \/ H108N Credential Disclosure”,”source”:””,”references”:””,”id”:”PACKETSTORM:221997″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-34474″],”sourceData”:”—–BEGIN SECURITY ADVISORY—–\\n \\n Advisory ID: MONX-2026-003\\n CVE ID: CVE-2026-34474\\n Title: ZTE ZXHN H298A \/ H108N – Unauthenticated Admin Password \\u0026\\n WLAN Credential Exposure\\n Affected: ZTE ZXHN H298A 1.1, ZTE ZXHN H108N 2.6 (EOL; no patch\\n planned)\\n Date: 2026-05-20\\n Author: Mina Nageh Salalma (Monx Research)\\n Contact: minanageh379@gmail.com\\n Public URL:\\n https:\/\/github.com\/minanagehsalalma\/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure\\n MITRE: https:\/\/www.cve.org\/CVERecord?id=CVE-2026-34474\\n \\n \\n VULNERABILITY DESCRIPTION\\n ————————–\\n A single unauthenticated HTTP GET to \/getpage.lua?pid=1000\\u0026ETHCheat=1 on ZTE\\n H298A or H108N routers returns the live administrator password\\n (OBJ_USERINFO_IDPassword1), WLAN PSK (WLANPSK_KeyPassphrase1), and SSID in\\n plaintext HTML. A second endpoint exposes the device serial number.\\n \\n Note: ZTE declined vendor-side assignment citing product EOL. MITRE assigned\\n CVE-2026-34474 directly and published the record 2026-05-06. These devices\\n remain deployed by some ISPs.\\n \\n \\n CREDITS\\n ——-\\n Mina Nageh Salalma (Monx Research)\\n https:\/\/github.com\/minanagehsalalma\\n \\n —–END SECURITY ADVISORY—–“,”sourceHref”:”https:\/\/packetstorm.news\/download\/221997″,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/221997\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-26T15:59:59″,”description”:”A single unauthenticated HTTP GET to \/getpage.lua?pid=1000\\u0026ETHCheat=1 on ZTE H298A or H108N routers returns the live administrator password OBJUSERINFOIDPassword1, WLAN PSK WLANPSKKeyPassphrase1, and SSID in…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,16,12,15,13,53,7,11,5],"class_list":["post-56964","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n