Threat Investigation
Request a demo

CVE-2026-34473

High

Description

Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, and H196Q. A denial-of-service condition can be triggered against the router's web interface by sending an oversized application/x-www-form-urlencoded POST body. After triggering, the management interface may become unresponsive until the device is rebooted. This may affect any firmware version prior to 2022 (reporter observation). The supplier stated that devices are not vulnerable since 2021-03-23; operator firmware may vary.

SeverityHigh
CVSS7.5
Exploit probability—
ProductH8102E
PublishedMay 6, 2026
First seenMay 6, 2026
Weakness typeCWE-400Uncontrolled resource consumption

How to fix

Update
  • ZTE H8102E2021-03-23 or later
  • ZTE H168N2021-03-23 or later
  • ZTE H167A2021-03-23 or later
  • ZTE H199A2021-03-23 or later
  • ZTE H288A2021-03-23 or later

Affected products

ProductAffected versionsFixed in
ZTE H8102ENo range specified2021-03-23
ZTE H168NNo range specified2021-03-23
ZTE H167ANo range specified2021-03-23
ZTE H199ANo range specified2021-03-23
ZTE H288ANo range specified2021-03-23

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.