[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-05-26 01:43 UTC
Importiert: 2026-06-09 06:33 UTC
CVSS: 7.5
Quelle-ID: full_disc
uid_hash: 00d9523cb273f5e0b800c873d2bf635e1e87bde0dbfff6e4f04cb6a2f92fdbeb

Full Disclosure

Posted by m.nageh on May 25 -----BEGIN SECURITY ADVISORY-----

Advisory ID: MONX-2026-001

CVE ID: CVE-2026-34473

Title: Unauthenticated Denial of Service via Oversized POST Body

in ZTE Router CGILua Parser

Affected: 17+ ZTE ZXHN router models (~140,000 publicly exposed

devices)

CVSS Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Date: 2026-05-20

Author: Mina Nageh Salalma (Monx Research)

Contact: minanageh379 () gmail...

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-34473	HIGH	7.5	HIGH	7.5			2026-05-06

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss