Hardcoded credentials

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in salutilstrencrypt in libsal.so.0.0. The parameters salt, IV, and key data are used to encrypt and decrypt all passwords using AES256...

CVE-2019-15799

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH while their...

CVE-2019-15799

The CVE-2019-15799 issue affects Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Web-interface accounts with non-admin privileges can, when connected via SSH, obtain administrator-level access identical to their web permissions. This allows normal users to run the tech-support command i...

CVE-2019-15800

CVE-2019-15800 affects Zyxel GS1900 switches with firmware before 2.50(AAHH.0)C0. The root cause is lack of input validation in libclicmd.so under the commands cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec(). This could allow an attacker to trigger system() and execute arb...

CVE-2019-15800

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Due to lack of input validation in the cmdsystracerouteexec, cmdsysarpclear, and cmdsyspingexec functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call...

CVE-2019-15801

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware,...

CVE-2019-15801

CVE-2019-15801 affects Zyxel GS1900 devices with firmware prior to 2.50(AAHH.0)C0. The firmware stores encrypted passwords used for diagnostics/password-recovery authentication. An attacker can decrypt these passwords using the hardcoded cryptographic key found elsewhere in the firmware, via the ...

CVE-2019-15802

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in salutilstrencrypt in libsal.so.0.0. The parameters salt, IV, and key data are used to encrypt and decrypt all passwords using AES256...

CVE-2019-15802

Affected product: Zyxel GS1900 switches. Vulnerability: firmware before 2.50(AAHH.0)C0 uses a hardcoded cryptographic key in libsal.so.0.0 to encrypt passwords via AES-256 CBC; the salt, IV, and key data are used to encrypt/decrypt all passwords, including those in config backups embedded in the ...

CVE-2019-15803

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fdssyspassDebugPasswdret. The...

CVE-2019-15803

The CVE-2019-15803 issue affects Zyxel GS1900 devices running firmware prior to 2.50(AAHH.0)C0. It stems from an undocumented keypress sequence that triggers a diagnostics shell via CTRL-ALT-t. The slider of access checks (fds_sys_remoteDebugEnable_ret in libfds.so) always returns TRUE, bypassing...

CVE-2019-15804

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application e.g., through CTRL+\ via SSH. The access...

CVE-2019-15804

CVE-2019-15804 affects Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending SIGQUIT to the CLI process (e.g., CTRL+\ via SSH), an undocumented menu can be triggered, exposing a "Password recovery for specific user" option. Access control blocks the menu, but it is believed to be r...

CVE-2019-15802: Use of Hard-coded Credentials

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in salutilstrencrypt in libsal.so.0.0. The parameters salt, IV, and key data are used to encrypt and decrypt all passwords using AES256...

PT-2019-4087

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware before 2.50AAHH.0C0 Description The issue is related to insufficient protection of registration data in the functions fds sys passDebugPasswd ret and fds sys passRecoveryPasswd ret of the libfds.so.0.0 librar...

PT-2019-4088

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware prior to 2.50AAHH.0C0 Description An issue exists due to insufficient input validation in the Password Recovery component of Zyxel GS1900 series routers. This issue can be triggered by sending a specific sign...

PT-2019-4110

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware before 2.50AAHH.0C0 Description An issue allows user accounts with non-admin level privileges to have the same level of privileged access as administrators when connecting to the device via SSH. This enables...

PT-2019-4113

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware prior to 2.50AAHH.0C0 Description An issue was discovered in Zyxel GS1900 devices, where an undocumented sequence of keypresses triggers undocumented functionality. This includes access to a diagnostics shell...

PT-2019-4286

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware before 2.50AAHH.0C0 Description The issue exists due to the hardcoding of registration data in the sal util str encrypt function of the Zyxel GS1900 series router firmware. This allows a remote attacker to...

CVE-2019-15801: Use of Hard-coded Credentials

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware,...