Lucene search

[email protected]CVE-2021-4030

HistoryFeb 24, 2022 - 3:15 p.m.

CVE-2021-4030

2022-02-2415:15:25

CWE-352

[email protected]

web.nvd.nist.gov

cve-2021-4030

cross-site request forgery

zyxel

armor

firmware

vulnerability

http daemon

arbitrary commands

compromised website

malicious scripts

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.0%

JSON

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts.

Affected configurations

NVD

Node

zyxelnbg6816_firmwareMatch1.00\(aawb.10\)c0

AND

zyxelnbg6816Match-

Node

zyxelnbg6817_firmwareRange<1.00\(abcs.11\)c0

AND

zyxelnbg6817Match-

CPENameOperatorVersion
zyxel:nbg6816_firmwarezyxel nbg6816 firmwareeq1.00\(aawb.10\)c0

CPE	Name	Operator	Version
zyxel:nbg6816_firmware	zyxel nbg6816 firmware	eq	1.00\(aawb.10\)c0

CNA Affected

[
  {
    "product": "ARMOR Z2 (NBG6817) firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "1.00(ABCS.10)C0"
      }
    ]
  },
  {
    "product": "ARMOR Z1 (NBG6816) firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "1.00(AAWB.10)C0"
      }
    ]
  }
]

References

www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.0%

JSON

Related for CVE-2021-4030

prion1 cvelist1 nvd1