Medium severity · published Jun 10, 2021
CVE-2021-21735
A ZTE product has an information leak vulnerability
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZH
Zxhn H168n Firmware · Zte
through 3.5.0_eg1t4_te · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21735
Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924
seclists.org
http://seclists.org/fulldisclosure/2026/May/21
More from Zxhn H168n Firmware
9.8
CVE-2024-45414
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function
9.8
CVE-2024-45415
The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function
9.8
CVE-2021-21730
A ZTE product is impacted by improper access control vulnerability
8.8
CVE-2018-7358
ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized…
8.8
CVE-2018-7357
ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized…