Lucene search

[email protected]CVE-2008-1527

HistoryMar 26, 2008 - 10:44 a.m.

CVE-2008-1527

2008-03-2610:44:00

CWE-310

[email protected]

web.nvd.nist.gov

cve-2008-1527

zyxel prestige routers

firmware vulnerability

authentication over http

hash string

hiddenpassword field

7.7 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.4%

JSON

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), support authentication over HTTP via a hash string in the hiddenPassword field, which allows remote attackers to obtain access via a replay attack.

CPENameOperatorVersion
zyxel:zynoszyxel zynoseq3.40
zyxel:prestige_661zyxel prestige 661eqhw-d1
zyxel:prestige_660zyxel prestige 660eqh-d3
zyxel:prestige_660zyxel prestige 660eqh-d1

CPE	Name	Operator	Version
zyxel:zynos	zyxel zynos	eq	3.40
zyxel:prestige_661	zyxel prestige 661	eq	hw-d1
zyxel:prestige_660	zyxel prestige 660	eq	h-d3
zyxel:prestige_660	zyxel prestige 660	eq	h-d1

References

www.gnucitizen.org/projects/router-hacking-challenge/

www.procheckup.com/Hacking_ZyXEL_Gateways.pdf

www.securityfocus.com/archive/1/489009/100/0/threaded

7.7 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.4%

JSON

Related for CVE-2008-1527

cvelist1 prion1