CVE-2025-53558

HIGH EXPLOITED NUCLEI

ZTE Japan K.K. ZXHN-F660T and ZXHN-F660A - Use of Weak Credentials

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-53558 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including houqe. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2025-53558, which appears to be an authentication bypass vulnerability. The script automates the login process by extracting a token, generating a hashed password, and attempting to authenticate as 'admin' with a default password.

Description

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.

Exploits (1)

nomisec WORKING POC
by houqe · remote
https://github.com/houqe/POC_CVE-2025-53558

This repository contains a functional exploit PoC for CVE-2025-53558, which appears to be an authentication bypass vulnerability. The script automates the login process by extracting a token, generating a hashed password, and attempting to authenticate as 'admin' with a default password.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Unknown (likely a web application with a login form using 'Frm_Logintoken')
No auth needed
Prerequisites: Target URL with vulnerable login endpoint · Default admin credentials (admin/admin)
devstral-2 · analyzed Feb 19, 2026 Full analysis →

Nuclei Templates (1)

ZTE ZXHN-F660T/F660A - Default Credentials
HIGHVERIFIEDby DhiyaneshDK
Shodan: title:"F660"

References (1)

Core 1
Core References
Third Party Advisory
https://jvn.jp/en/jp/JVN66546573/

Scores

CVSS v3 8.8
EPSS 0.2258
EPSS Percentile 96.0%
Attack Vector ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

VulnCheck KEV 2026-04-30
CWE
CWE-1391
Status published
Products (2)
ZTE Japan. K.K./ZXHN-F660A prior to V1.0.10P14N4
ZTE Japan. K.K./ZXHN-F660T prior to V1.0.10P17N4
Published Jul 31, 2025
Tracked Since Feb 18, 2026