This vulnerability involves unauthenticated credential disclosure through the router's wizard interface, enabling local network attackers to retrieve sensitive information including administrative and network credentials. Additionally, some instances allow unauthorized configuration changes. The affected products are ZTE ZXHN H188A versions V6.0.10P2_TE and V6.0.10P3N3_TE. The CVSS 3.1 vector indicates the attack requires local network access (AV:A), has low attack complexity (AC:L), requires no privileges or user interaction (PR:N, UI:N), and impacts confidentiality highly (C:H), integrity partially (I:L), and availability not at all (A:N). There is no known exploit in the wild and no vendor patch or advisory has been provided at this time.

An unauthenticated attacker on the local network can retrieve highly sensitive credentials including the default administrator password, WLAN PSK, and PPPoE credentials from the router. This compromises the confidentiality of the device and network. Some observed cases also allow unauthorized configuration changes, impacting integrity. There is no reported impact on availability. The vulnerability poses a significant risk to network security and device control if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local network access to trusted users only and consider isolating the device from untrusted local networks. Monitor for vendor updates regarding patches or mitigations.