ZTE ZXHN F477V2 (F477V2)

ZTE ZXHN F477V2 (F477V2)
Security Grade F Calculator v	ZTE ZXHN F477V2 (F477V2) Brand: ZTE (Parent: ZTE Corporation) Category: Router • Model / Gen: F477V2 Release Date: 2018-01-01 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	—
Known vulnerabilities	Very common	🔗 Proof
Prior attacks	Rare	🔗 Proof
Updatability	None	—
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—
Communications	Encrypted with obselete encryption	—
Storage	No encryption	—
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—
Authentication	Basic	🔗 Proof
Brute-force protection	Basic	—
Event logging	Partial logging	—
Passwords	Default/Common/Easy to guess	—
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	ZTE Embedded OS (Companion App: )
Hardware (CPU / GPU)	CPU: Broadcom BCM68380 • GPU:
Memory & Storage	Memory: 256 MB RAM • Storage: 128MB Flash
Power, Battery & Charging	Battery: None • Power: 12V DC adapter • Charging:
Display & Camera	Display: None • Camera: None
Sound & Connectivity	Sound: • Connectivity: 4 x GE LAN, GPON/EPON, 2.4GHz Wi-Fi
Physical (Dimensions & Mass)	Dimensions: • Mass:

This EPON ONU is affected by CVE-2022-23135, a directory traversal flaw in ZTE ZXHN F477 home gateways (CVSS 6.5, Medium). An authenticated attacker can modify the FTP destination path to access or modify system files, which leads to information leakage and disrupted device operation. All firmware versions up to V9.0.0P1N28 are affected. In addition, the device label prints the default management address, username and password in plain text, so anyone with physical access can log in as an administrator.