Lucene search

[email protected]CVE-2019-15801

HistoryNov 14, 2019 - 9:15 p.m.

CVE-2019-15801

2019-11-1421:15:11

CWE-798

[email protected]

web.nvd.nist.gov

zyxel

gs1900

firmware

vulnerability

decryption

password

authentication

nvd

cve-2019-15801

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

66.1%

JSON

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0.

Affected configurations

NVD

Node

zyxelgs1900-8_firmwareRange<2.50\(aahh.0\)c0

AND

zyxelgs1900-8Match-

Node

zyxelgs1900-8hp_firmwareRange<2.50\(aahi.0\)c0

AND

zyxelgs1900-8hpMatch-

Node

zyxelgs1900-10hp_firmwareRange<2.50\(aazi.0\)c0

AND

zyxelgs1900-10hpMatch-

Node

zyxelgs1900-16_firmwareRange<2.50\(aahj.0\)c0

AND

zyxelgs1900-16Match-

Node

zyxelgs1900-24e_firmwareRange<2.50\(aahk.0\)c0

AND

zyxelgs1900-24eMatch-

Node

zyxelgs1900-24_firmwareRange<2.50\(aahl.0\)c0

AND

zyxelgs1900-24Match-

Node

zyxelgs1900-24hp_firmwareRange<2.50\(aahm.0\)c0

AND

zyxelgs1900-24hpMatch-

Node

zyxelgs1900-48_firmwareRange<2.50\(aahn.0\)c0

AND

zyxelgs1900-48Match-

Node

zyxelgs1900-48hp_firmwareRange<2.50\(aaho.0\)c0

AND

zyxelgs1900-48hpMatch-

CPENameOperatorVersion
zyxel:gs1900-8_firmwarezyxel gs1900-8 firmwarelt2.50\(aahh.0\)c0

CPE	Name	Operator	Version
zyxel:gs1900-8_firmware	zyxel gs1900-8 firmware	lt	2.50\(aahh.0\)c0

References

jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html

www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

66.1%

JSON

Related for CVE-2019-15801

nvd1 cvelist1 prion1