Read the docs
TI-2021-04802 Aliases CVE-2021-21735GHSA-j3rv-rh4f-4rf6

A ZTE product has an information leak vulnerability.

Priority LOW 31CWE-281Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.

Why it matters now

EPSS 0.00947 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ZXHN H168NAll versions up to V3.5.0_EG1T4_TE—No fix listedCNA
  • ZXHN H168N Vendor— Affected All versions up to V3.5.0_EG1T4_TE Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:zte:zxhn_h168n_firmware:*:*:*:*:*:*:*:*up to 3.5.0_eg1t4_teVulnerableZTE
cpe:2.3:h:zte:zxhn_h168n:-:*:*:*:*:*:*:*not specified by NVDRunning onZTE
  • cpe:2.3:o:zte:zxhn_h168n_firmware:*:*:*:*:*:*:*:* Versions up to 3.5.0_eg1t4_te Vulnerable ·ZTE
  • cpe:2.3:h:zte:zxhn_h168n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ZTE

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21735
  2. 2026-10-03 Alias added: GHSA-j3rv-rh4f-4rf6

References

Advisory 1

  • TI-2018-05334 Improper authentication in ZTE ZXHN H168N CVSS 3.0HIGH 8.8
  • TI-2018-05333 Missing authentication in ZTE ZXHN H168N CVSS 3.0HIGH 8.8
  • TI-2021-04797 A ZTE product is impacted by improper access control vulnerability. CVSS 3.1CRITICAL 9.8
  • TI-2021-04796 Cross-site request forgery in ZXHN H168N,ZXHN H108N CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences