[Full-disclosure] [ISR] Zyxel Prestige 650R-31 Denial Of Service

|| || Infobyte Security Research || www.infobyte.com.ar || 04.08.2005 || .:: SUMMARY Prestige 650R-31 ADSL Router -CPU exausting handling malformed fragmented packets Affected ZyNOS FW v3.40KO.1 It is suspected that all previous versions of ZyNOS are vulnerable. .:: BACKGROUND Zyxel Prestige 600...

CVE-2004-1540

CVE-2004-1540 affects ZyXEL Prestige routers (623, 650, 652) where HTTP Remote Administration is enabled. The vulnerability exists because access to the page “/rpFWUpload.html” does not require authentication, enabling a remote attacker to reset the router configuration to its factory state. Docu...

ZyXel Prestige information leak

Memory fragments are leaked in ARP packets...

Zyxel Prestige 681 SDSL router information leak

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Zyxel P681 with ZyNOS S/W Version: Vt020225a | 2/25/2002 installed leaks random portions of memory in ARP requests: 21:47:05.709295 arp who-has x.x.x.x tell x.x.x.x 0x0000 0001 0800 0604 0001 00a0 c526 3cc1 xxxx ................ 0x0010 xxxx 000...

CVE-2004-0670

Prestige 650HW-31 running Rompager 4.7 software allows remote attackers to cause a denial of service device reboot via a long password...

CVE-2004-0670

CVE-2004-0670 affects Prestige 650HW-31 devices running Rompager 4.7. The issue allows remote attackers to trigger a denial of service (device reboot) by submitting a long password. The documents do not provide exploitation details, affected software versions beyond Rompager 4.7 on the Prestige 6...

ZyXel Prestige 650 buffer overflow

Buffer overflow on oversized password...

[Full-Disclosure] DSL router Prestige 650HW-31

Hi, have not much time so here is the thing... There's a bug in the DSL router Prestige 650HW-31, you just post a long string as password and the router resets it self so is very easy to make a DNS to this router if people doesnt have the aproppiate filters on port 80 I didnt tried on Telnet. Thi...

CVE-2002-1071

ZyXEL Prestige 642R allows remote attackers to cause a denial of service in the Telnet, FTP, and DHCP services crash via a TCP packet with both the SYN and ACK flags set...

CVE-2002-1072

ZyXEL Prestige 642R 2.50FA.1 and Prestige 310 V3.25M.01, allows remote attackers to cause a denial of service via an oversized, fragmented "jolt" style ICMP packet...

CVE-2002-1071

CVE-2002-1071 affects ZyXEL Prestige 642R. A remote attacker can cause denial of service on Telnet, FTP, and DHCP services by sending a TCP packet with both SYN and ACK flags set. The description in the sources confirms the crash vector but does not provide specific patch versions or remediation ...

CVE-2002-1072

CVE-2002-1072 affects ZyXEL Prestige devices (642R and Prestige 310) due to a vulnerability in handling oversized, fragmented ICMP packets (jolt style). The issue allows remote attackers to induce a denial of service. The available sources confirm affected models and the general impact (availabil...

CVE-2002-1071

ZyXEL Prestige 642R allows remote attackers to cause a denial of service in the Telnet, FTP, and DHCP services crash via a TCP packet with both the SYN and ACK flags set...

Zyxel Prestige DoS

Problems with fragmented packets processing, Syn+fin and Syn+ack packets...

CVE-2001-1194

Zyxel Prestige 681 and 1600 SDSL Routers allow remote attackers to cause a denial of service via malformed packets with 1 an IP length less than actual packet size, or 2 fragmented packets whose size exceeds 64 kilobytes after reassembly...

CVE-2001-1135

ZyXEL Prestige 642R and 642R-I routers do not filter the routers' Telnet and FTP ports on the external WAN interface from inside access, allowing someone on an internal computer to reconfigure the router, if the password is known...

CVE-2001-1194

CVE-2001-1194 affects Zyxel Prestige 681 and 1600 SDSL Routers. Remote attackers can cause a denial of service by sending malformed packets: (1) IP length shorter than the actual packet size, or (2) fragmented packets whose reassembly size exceeds 64 KB. Impact is denial of service/partial availa...

CVE-2001-1135

The CVE-2001-1135 issue affects ZyXEL Prestige 642R and 642R-I routers. According to the connected documents, these devices can be reconfigured if the internal user knows the password and there is evidence of default credentials being present (HTTP web interface). The OpenVAS/Nessus entries indic...

Re: Zyxel Prestige 681 and 1600 (possibly other?) remote DoS

On Friday 14 December 2001 12:08, Przemyslaw Frasunek wrote: The workaround is to switch off routing and put device in bridging mode. Zyxel support has been notified, I won't release details of attack, until ZyNOS will be patched. I haven't received any response from Zyxel helpdesk so time to...

Zyxel Prestige 681 and 1600 (possibly other?) remote DoS

Hello, Zyxel Prestige 681 SDSL router is vulnerable to remote denial of service. By sending malformed packets, it is possible to bring down DSL link for few minutes. The problem persists only if packets come from DSL interface, not from Ethernet. ZyNOS reports that line is synchronizing and it...