CVE-2021-35031

🗓️ 28 Dec 2021 10:36:23Reported by ZyxelType

A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device

Reporter	Title	Published	Views	Family All 9
BDU FSTEC	The vulnerability of the TFTP-client software for Zyxel GS1900 and XGS1210 series switch devices allows a intruder to execute arbitrary commands.	17 Feb 202200:00	–	bdu_fstec
CNNVD	ZyXEL GS1900 操作系统命令注入漏洞	28 Dec 202100:00	–	cnnvd
CNVD	ZyXEL GS1900 Access Control Error Vulnerability	29 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-35031	28 Dec 202110:36	–	cvelist
EUVD	EUVD-2021-21678	7 Oct 202500:30	–	euvd
NVD	CVE-2021-35031	28 Dec 202111:15	–	nvd
OSV	CVE-2021-35031	28 Dec 202111:15	–	osv
Prion	Design/Logic Flaw	28 Dec 202111:15	–	prion
RedhatCVE	CVE-2021-35031	22 May 202519:53	–	redhatcve

NVD

Node

zyxel gs1900-8_firmwareRange<2.70(aahh.0)-20211208

AND

zyxel gs1900-8Match-

Node

zyxel gs1900-8hp_firmwareRange<2.70(aahi.0)-20211208

AND

zyxel gs1900-8hpMatch-

Node

zyxel gs1900-10hp_firmwareRange<2.70(aazi.0)-20211208

AND

zyxel gs1900-10hpMatch-

Node

zyxel gs1900-16_firmwareRange<2.70(aahj.0)-20211208

AND

zyxel gs1900-16Match-

Node

zyxel gs1900-24e_firmwareRange<2.70(aahk.0)-20211208

AND

zyxel gs1900-24eMatch-

Node

zyxel gs1900-24ep_firmwareRange<2.70(abto.0)-20211208

AND

zyxel gs1900-24epMatch-

Node

zyxel gs1900-24_firmwareRange<2.70(aahl.0)-20211208

AND

zyxel gs1900-24Match-

Node

zyxel gs1900-24hp_firmwareRange<2.70(aahm.0)-20211208

AND

zyxel gs1900-24hpMatch-

Node

zyxel gs1900-24hpv2_firmwareRange<2.70(aatp.0)-20211208

AND

zyxel gs1900-24hpv2Match-

Node

zyxel gs1900-48_firmwareRange<2.70(aahn.0)-20211208

AND

zyxel gs1900-48Match-

Node

zyxel gs1900-48hp_firmwareRange<2.70(aaho.0)-20211208

AND

zyxel gs1900-48hpMatch-

Node

zyxel gs1900-48hpv2_firmwareRange<2.70(abtq.0)-20211208

AND

zyxel gs1900-48hpv2Match-

Node

zyxel xgs1210-12_firmwareRange<1.00(abty.5)c0

AND

zyxel xgs1210-12Match-

Node

zyxel xgs1250-12_firmwareRange<1.00(abwe.1)c0

AND

zyxel xgs1250-12Match-

[
  {
    "product": "GS1900 series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "2.60"
      }
    ]
  },
  {
    "product": "XGS1210 series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "1.00(ABTY.4)C0"
      }
    ]
  },
  {
    "product": "XGS1250 series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "1.00(ABWE.0)C0"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml

21 Nov 2024 06:11Current

8High risk

Vulners AI Score8

CVSS 27.7

CVSS 3.16.8 - 8

EPSS0.00085

CWE-78