CVE-2026-49005

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-08-07

Last updated on: 2026-08-26

Assigner: ZTE Corporation

Description

The root password hash of the device can be obtained through unencrypted information in the firmware.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-26

Generated

2026-10-06

AI Q&A

2026-08-07

EPSS Evaluated

2026-10-05

NVD

CVE-2026-49005

EUVD

EUVD-2026-54357

Affected Vendors & Products

Vendor	Product	Version / Range
ZTE	F689	ZXHN F680V9.0.10P6N1,ZXHN F680V9.0.10P4N4,ZXHN F680V9.0.10P4N5,ZXHN F680V9.0.10P4N9,ZXHN F680V9.0.10P4N10,ZXHN F680V9.0.10P1N12,ZXHN F680V9.0.10P1N13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-916	The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to retrieve the root password hash from a device's firmware through unencrypted data. The firmware contains sensitive information that should be protected but is exposed in plaintext.

Detection Guidance

This vulnerability involves exposure of the root password hash in firmware. Detection requires analyzing firmware files for unencrypted password hashes. Use tools like binwalk to extract firmware images and search for hash strings (e.g., /etc/shadow contents). No direct commands apply to live systems as this is a firmware-level issue.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the device by cracking the root password hash. This could lead to full control over the device, data theft, or further network compromise.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA, as it exposes sensitive authentication data. Organizations may face penalties for failing to secure such information adequately.

Mitigation Strategies

Update the device firmware to the latest version to ensure the root password hash is no longer exposed in unencrypted form. Restrict physical and network access to the device to prevent unauthorized extraction of sensitive data.

Hi! I’m here to help you understand CVE-2026-49005. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70