Lucene search

PRIOn knowledge basePRION:CVE-2022-34746

HistorySep 20, 2022 - 2:15 a.m.

Design/Logic Flaw

2022-09-2002:15:00

PRIOn knowledge base

www.prio-n.com

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.7 Medium

AI Score

Confidence

High

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

43.0%

JSON

An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.

CPENameOperatorVersion
gs1900-10hp_firmwareeq< 2.70aazi.3c0
gs1900-16_firmwareeq< 2.70aahj.3c0
gs1900-24_firmwareeq< 2.70aahl.3c0
gs1900-24e_firmwareeq< 2.70aahk.3c0
gs1900-24ep_firmwareeq< 2.70abto.3c0
gs1900-24hpv2_firmwareeq< 2.70abtp.3c0
gs1900-48_firmwareeq< 2.70aahn.3c0
gs1900-48hpv2_firmwareeq< 2.70abtq.3c0
gs1900-8_firmwareeq< 2.70aahh.3c0
gs1900-8hp_firmwareeq< 2.70aahi.3c0

Name	Operator	Version
gs1900-10hp_firmware	eq	< 2.70aazi.3c0
gs1900-16_firmware	eq	< 2.70aahj.3c0
gs1900-24_firmware	eq	< 2.70aahl.3c0
gs1900-24e_firmware	eq	< 2.70aahk.3c0
gs1900-24ep_firmware	eq	< 2.70abto.3c0
gs1900-24hpv2_firmware	eq	< 2.70abtp.3c0
gs1900-48_firmware	eq	< 2.70aahn.3c0
gs1900-48hpv2_firmware	eq	< 2.70abtq.3c0
gs1900-8_firmware	eq	< 2.70aahh.3c0
gs1900-8hp_firmware	eq	< 2.70aahi.3c0

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-of-gs1900-series-switches

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.7 Medium

AI Score

Confidence

High

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

43.0%

JSON

Related for PRION:CVE-2022-34746

cve1