TI-2025-33495 Aliases CVE-2025-53558 GHSA-4xg9-h72c-fxfm

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K.

MEDIUM 43CWE-1391Published 2025-07-31 · Updated 2025-07-31

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01502 74th percentileScored 2026-11-07

Fix Fixed ZXHN-F660T (ZTE Japan. K.K.): V1.0.10P17N4ZXHN-F660A (ZTE Japan. K.K.): V1.0.10P14N4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ZTE Japan. K.K.	ZXHN-F660T	before V1.0.10P17N4	V1.0.10P17N4	Patch available	CNA
ZTE Japan. K.K.	ZXHN-F660A	before V1.0.10P14N4	V1.0.10P14N4	Patch available	CNA

ZXHN-F660T VendorZTE Japan. K.K. Affected before V1.0.10P17N4 Fixed in V1.0.10P17N4 Patch available CNA
ZXHN-F660A VendorZTE Japan. K.K. Affected before V1.0.10P14N4 Fixed in V1.0.10P14N4 Patch available CNA

Remediation

Fix · CNA ZXHN-F660T (ZTE Japan. K.K.) Fixed in V1.0.10P17N4
Fix · CNA ZXHN-F660A (ZTE Japan. K.K.) Fixed in V1.0.10P14N4

Timeline

2026-10-02 Threatist record created from CVE-2025-53558
2026-10-03 Alias added: GHSA-4xg9-h72c-fxfm

References

Other 1

https://jvn.jp/en/jp/JVN66546573/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences