ExploitPublished 1 May 2025

ZTE ZXV10 H201L · RCE via authentication bypass

Source Exploit-DB RSS Feed

Severity

Critical

Rated by Threat Radar

Data as of 11 Jun 2025, 21:08 UTC

What to do

AI-suggested

1. Immediate Network Segmentation: Isolate ZTE ZXV10 H201L routers from critical internal networks and restrict management interface access to trusted administrative hosts only, preferably via VPN or dedicated management VLANs. 2. Disable Remote Management: If remote HTTP management is enabled, disable it or restrict it to specific IP addresses to prevent unauthorized external access. 3. Monitor Network Traffic: Deploy IDS/IPS signatures to detect anomalous POST requests to /getpage.gch endpoints and unusual DDNS configuration changes indicative of exploitation attempts. 4. Change Default Encryption Key: If possible, change or randomize the configuration encryption key to prevent decryption of configuration files using the known default key. 5. Firmware Updates: Engage with ZTE or ISPs to obtain firmware updates or patches addressing the authentication bypass vulnerability. If unavailable, consider replacing vulnerable devices with more secure alternatives. 6. Implement Strong Access Controls: Enforce strong authentication and authorization policies on router management interfaces, including multi-factor authentication where supported. 7. Incident Response Preparedness: Prepare to detect and respond to signs of compromise, such as unexpected files in /var/tmp or unauthorized configuration changes. 8. Vendor Coordination: Report the vulnerability to ZTE and relevant national cybersecurity authorities to accelerate patch development and coordinated disclosure. 9. Regular Audits: Conduct periodic security audits of network devices to identify vulnerable models and verify configuration integrity. 10. User Awareness: Educate network administrators about the risks of default credentials and the importance of securing management interfaces.

Description

ZTE ZXV10 H201L - RCE via authentication bypass

Impact

For European organizations, this vulnerability poses a severe risk to network infrastructure security and operational continuity. Compromise of the ZTE ZXV10 H201L routers can lead to full control over the device, allowing attackers to intercept, modify, or redirect network traffic, potentially enabling man-in-the-middle attacks, data exfiltration, or lateral movement within corporate networks. The ability to execute arbitrary commands remotely without authentication significantly increases the attack surface, enabling attackers to deploy persistent backdoors, disrupt services, or use compromised routers as pivot points for further attacks. Given that these routers are often deployed at the network edge or in customer premises equipment (CPE), exploitation could affect both enterprise and residential users, impacting confidentiality, integrity, and availability of communications. The lack of available patches and the presence of publicly available exploit code increase the likelihood of exploitation attempts. Organizations relying on these devices for critical connectivity or managed services may face service outages, regulatory compliance violations (e.g., GDPR breaches due to data interception), and reputational damage. Additionally, attackers could leverage compromised routers to launch distributed denial-of-service (DDoS) attacks or other malicious campaigns, amplifying the threat beyond the initial target.

Indicators of compromise

Exploit source code

Exploit code for ZTE ZXV10 H201L - RCE via authentication bypass8,732 characters

# Exploit Title: ZTE ZXV10 H201L - RCE via authentication bypass
# Exploit Author:  l34n (tasos meletlidis)
# https://i0.rs/blog/finding-0click-rce-on-two-zte-routers/

import http.client, requests, os, argparse, struct, zlib
from io import BytesIO
from os import stat
from Crypto.Cipher import AES

def login(session, host, port, username, password):
    login_token = session.get(f"http://{host}:{port}/").text.split("getObj(\"Frm_Logintoken\").value = \"")[1].split("\"")[0]
    
    headers = {
 …

References

Community reviews

Loading reviews…