CVE-2021-21725
Description
CVE-2021-21725 is a medium-severity information leak in ZTE ZXHN H196Q V9.1.0C2 allowing higher-privileged attackers to access files in other directories.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
CVE-2021-21725 is a medium-severity information leak in ZTE ZXHN H196Q V9.1.0C2 allowing higher-privileged attackers to access files in other directories.
Vulnerability
CVE-2021-21725 is an information leak vulnerability in the ZTE ZXHN H196Q router running firmware version V9.1.0C2. The bug allows an attacker with higher authority to bypass authority restrictions and access files in other directories by performing specific operations [1]. The vulnerability has been addressed in the resolved version V9.1.0C3 [1].
Exploitation
Exploitation requires the attacker to have higher authority (e.g., administrative privileges) on the device and to perform specific operations, though the exact sequence is not publicly detailed. The attacker must be on the adjacent network (AV:A) and have low privileges (PR:L), with no user interaction needed (UI:N). The attack complexity is high (AC:H) [1].
Impact
Successful exploitation results in unauthorized access to files in other directories, leading to information disclosure. The confidentiality impact is rated high (C:H), while integrity and availability are not affected [1].
Mitigation
ZTE has released the fixed firmware version V9.1.0C3 for the ZXHN H196Q. Users should upgrade to this version to mitigate the vulnerability [1]. No workarounds have been published. The vulnerability is not listed on the CISA KEV.
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- ZTE/ZXHN H196Qdescription
- Range: = V9.1.0C2
Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
1- support.zte.com.cn/support/news/LoopholeInfoDetail.aspxmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.