Unauthenticated attackers on a local network can retrieve sensitive information from the ZTE ZXHN H188A router’s web interface, including the default administrator password, WLAN pre-shared key, and PPPoE credentials. In some instances the attacker may also alter router settings without authentication, elevating the risk of unauthorized changes to network configuration. The weakness follows two common categories of insecure design: exposure of confidential data and lack of proper authentication controls.

The vulnerability affects ZTE ZXHN H188A routers running firmware versions 6.0.10P2_TE and 6.0.10P3N3_TE. Users of these specific firmware releases should verify their device version and consider upgrading if possible.

With a CVSS score of 7.1 the problem is of moderate to high severity. The EPSS score is below 1 %, indicating low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is inferred to be local network access without authentication, which is typically achievable for anyone connected to the same LAN. The attacker can easily gather credentials and, in some cases, reconfigure network settings, potentially compromising entire network security.