CVE-2015-7251

Published: Dec 30, 2015Updated: May 6, 2026 Sources: CVE List NVDCWE-255

9.8CRITICAL

NVD MITRE

Description

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session.

In plain language

AI Worth attention

ZTE ZXHN H108N R1A firmware before ZTE.bhs.ZXHNH108NR1A.k_PE can let a network attacker take over the router, so affected businesses should act.

Executive summary

Unauthenticated network administrative access is possible because the device exposes a hardcoded root credential through TELNET.

If affected, business impact

Full router takeoverInternet traffic interceptionNetwork service disruptionMalware entry point

What to do now

Check whether you use a ZTE ZXHN H108N R1A router and identify its installed firmware version.
If it is before ZTE.bhs.ZXHNH108NR1A.k_PE, contact ZTE or your internet provider for a supported replacement or firmware update; no confirmed fixed version is available in the patch findings.
Disable TELNET access, especially from the internet, until the device is replaced or updated.
Change router administrator passwords and review its configuration for unfamiliar settings after securing access.

May need vendor / contractor work

What is it

This is a built-in administrator password that was left the same on affected routers. It is like installing a shop’s master lock with the key taped to the front door: someone who can reach the router may be able to take control of it.

Who is affected

This matters to you if you use or manage a ZTE ZXHN H108N R1A router. It is a risk only when the router runs an affected firmware version and its TELNET service is reachable from the network.

How urgent is it

Public attack code is available, so attackers do not need to develop this attack themselves. Treat this as an amber-priority issue: restrict TELNET access promptly and arrange a supported update or replacement, particularly for routers reachable from outside your business.

What to do — in detail

Confirm the model, installed firmware, and whether TELNET is enabled or reachable from internal networks or the internet. Firmware versions before ZTE.bhs.ZXHNH108NR1A.k_PE are affected; the available patch findings do not confirm a fixed release or supported upgrade path, so obtain guidance from ZTE, the ISP, or the device supplier before installing firmware.

If patching is delayed, disable TELNET or restrict it to a tightly controlled administrator network, block inbound TELNET at the firewall, and remove any internet exposure. Plan replacement if no supported firmware is available. Review router administration logs and configuration changes for unexpected administrator access, DNS changes, port-forwarding rules, or remote-management settings. CVE-2015-7251 is not listed in CISA KEV, so there is no CISA remediation due date.

Technical context

CVE-2015-7251 has CVSS 9.8 Critical (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is CWE-255, involving a hardcoded credential for the root account exposed through TELNET; exploitation is network-based, requires no authentication or user interaction, and is reachable in the default configuration when TELNET is accessible. One public exploit is known. It is not in CISA KEV. EPSS predicts 10.7% likelihood (96th percentile) and is falling; this is a prediction, not confirmation of active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.