CVE-2018-7357: ZTE ZXHN H168N router missing authentication for critical function

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with no authentication or user interaction required, public exploit code available, and very high EPSS, though exploitation is limited to adjacent network access.

What it is

ZTE ZXHN H168N firmware versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T expose a critical function without authentication (CWE-306), allowing an unauthorized user to gain unauthorized access. The flaw is rated CVSS 3.0 8.8 (High) and affects a consumer-grade home router, so unpatched devices on a network segment are exposed.

Impact

An attacker on the adjacent network can reach the affected function without credentials and gain unauthorized access, with high impact to confidentiality, integrity and availability per the CVSS vector. On a home router this can mean full control of the device and the traffic passing through it.

Attack surface

The CVSS vector AV:A/AC:L/PR:N/UI:N indicates the flaw is reachable from an adjacent network with no authentication and no user interaction. It is not described as remotely exploitable over the internet, so exposure is limited to hosts on the same network segment or link.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.8787, 99.75th percentile) and a public Exploit-DB entry (45972) exists, so working exploit code is publicly available. No ransomware association is documented.

What to do

• Apply the ZTE vendor firmware update referenced in the ZTE advisory (newsId=1009523) for the affected ZXHN H168N versions.
• If no fixed firmware is available, replace the device or isolate it on a segmented network with no access to sensitive hosts.
• Restrict management and LAN-side access to the router so only trusted devices can reach it.
• Disable remote management and unnecessary services on the device.
• Monitor the vendor advisory for updated firmware and re-check affected version coverage.

Detection

• Monitor router and network logs for unauthenticated access attempts or configuration changes on ZXHN H168N devices.
• Watch for unexpected admin sessions, new users or changed settings on affected routers.
• Use network monitoring to detect hosts on the LAN reaching the router's management interface outside normal admin activity.
• Inventory ZXHN H168N devices and verify firmware versions against the affected list.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.