CVE-2026-49005: CWE-916 Use of password hash with insufficient computational effort in ZTE F689
CVE-2026-49005 is a low-severity vulnerability in the ZTE F689 device where the root password hash can be extracted from unencrypted firmware data. The weakness involves the use of a password hash with insufficient computational effort, classified under CWE-916. This vulnerability does not have a known exploit in the wild and no official patch or remediation guidance has been provided by the vendor. The impact is limited to potential exposure of the root password hash, which could aid an attacker with physical or firmware access. No affected software versions are explicitly stated.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-49005) affects the ZTE F689 device and involves the exposure of the root password hash through unencrypted information present in the device firmware. The password hash uses insufficient computational effort, making it easier to potentially crack. The CVSS v3.1 base score is 2.4, reflecting low impact, with an attack vector requiring physical access (AV:P), low attack complexity, no privileges or user interaction needed, and limited confidentiality impact. There is no vendor advisory or patch available at this time.
Potential Impact
The exposure of the root password hash in unencrypted firmware could allow an attacker with access to the firmware to attempt offline password cracking. However, the low CVSS score and lack of known exploits indicate limited practical impact. Confidentiality is partially affected, while integrity and availability are not impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit physical and firmware access to trusted personnel and devices to reduce risk.
CVE-2026-49005: CWE-916 Use of password hash with insufficient computational effort in ZTE F689
Description
CVE-2026-49005 is a low-severity vulnerability in the ZTE F689 device where the root password hash can be extracted from unencrypted firmware data. The weakness involves the use of a password hash with insufficient computational effort, classified under CWE-916. This vulnerability does not have a known exploit in the wild and no official patch or remediation guidance has been provided by the vendor. The impact is limited to potential exposure of the root password hash, which could aid an attacker with physical or firmware access. No affected software versions are explicitly stated.
CVSS v3.1
Score 2.4low
Affected software
ZTE
F689
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-49005) affects the ZTE F689 device and involves the exposure of the root password hash through unencrypted information present in the device firmware. The password hash uses insufficient computational effort, making it easier to potentially crack. The CVSS v3.1 base score is 2.4, reflecting low impact, with an attack vector requiring physical access (AV:P), low attack complexity, no privileges or user interaction needed, and limited confidentiality impact. There is no vendor advisory or patch available at this time.
Potential Impact
The exposure of the root password hash in unencrypted firmware could allow an attacker with access to the firmware to attempt offline password cracking. However, the low CVSS score and lack of known exploits indicate limited practical impact. Confidentiality is partially affected, while integrity and availability are not impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit physical and firmware access to trusted personnel and devices to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zte
- Date Reserved
- 2026-05-27T01:01:53.327Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a755e94bf8831d539bdaa04
Added to database: 08/07/2026, 04:27:00 UTC
Last enriched: 08/14/2026, 16:13:31 UTC
Last updated: 09/21/2026, 22:01:35 UTC
Views: 56
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.