{"uuid": "90907f44-09f2-47d4-9e94-b2d03d9d143a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21735", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/186047", "content": "CVE-2021-21735 is a good reminder that router testing should not stop at the login page. On the ZTE ZXHN H168N V3.5, setup/wizard handlers exposed PPPoE and WLAN material through routes that should have stayed behind an authenticated configuration boundary. The interesting part was not a default password or brute force path. It was setup logic being trusted too much. The write-up focuses on what to test in embedded web interfaces: onboarding routes, wizard handlers, hidden config endpoints, password-return actions, and firmware-side route allowlists.    submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://minanagehsalalma.github.io/cve-2021-21735-zte-zxhn-h168n-admin-compromise/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1tnc5cg/why_router_setup_wizards_pages_are_the_trickiest/)", "creation_timestamp": "2026-09-02T01:00:19.893807Z"}