CVE-2026-34474 is an unauthenticated information disclosure vulnerability in ZTE ZXHN H298A 1.1 and H108N 2.6 routers. By sending a specially crafted request to the router's web interface, an attacker can retrieve sensitive data including administrator passwords and WLAN PSKs, potentially enabling authentication bypass and network compromise. Some affected firmware versions may only leak partial device identifiers such as serial numbers, ESSIDs, or MAC addresses. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No vendor patch or official remediation guidance is currently available, and no known exploits have been reported in the wild.

The vulnerability allows unauthenticated remote attackers to access sensitive information such as administrator passwords and WLAN pre-shared keys from affected ZTE router models. This exposure can lead to authentication bypass and unauthorized network access. The confidentiality impact is high, but integrity and availability are not affected. Partial information leakage (serial numbers, ESSIDs, MAC addresses) may occur on some firmware versions, which could aid further targeted attacks.

No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor communications for updates and consider network-level protections such as restricting access to the router's web interface from untrusted networks. Since no known exploits are in the wild, urgent remediation is not indicated, but caution is advised.