ZyXEL ZyWALL Quagga/Zebra (default pass) Remote Root Vulnerability

🗓️ 22 Mar 2008 00:00:00Reported by RootType

ZyXEL ZyWALL Quagga/Zebra remote root vulnerability discovered by Pranav Joshi in March 2008. Default password 'zebra' allows unauthorized access to routing daemon on ports 2601, 2602, and 2604, potentially affecting ZyWALL 1050

Reporter	Title	Published	Views	Family All 12
0day.today	ZyXEL ZyWALL Quagga/Zebra (default pass) Remote Root Vulnerability	21 Mar 200800:00	–	zdt
Circl	CVE-2008-1160	21 Mar 200800:00	–	circl
CVE	CVE-2008-1160	25 Mar 200800:00	–	cve
Cvelist	CVE-2008-1160	25 Mar 200800:00	–	cvelist
Exploit DB	ZYXEL ZyWALL Quagga/Zebra - 'Default Password' Remote Code Execution	21 Mar 200800:00	–	exploitdb
exploitpack	ZYXEL ZyWALL QuaggaZebra - Default Password Remote Code Execution	21 Mar 200800:00	–	exploitpack
NVD	CVE-2008-1160	25 Mar 200800:44	–	nvd
Prion	Hardcoded credentials	25 Mar 200800:44	–	prion
Positive Technologies	PT-2008-1001 · Zyxel +1 · Zywall Usg 300 +3	24 Mar 200800:00	–	ptsecurity
securityvulns	ZyXEL ZyWALL Quagga/Zebra Remote Root Vulnerability	22 Mar 200800:00	–	securityvulns


                                                Name:&nbsp;ZyXEL&nbsp;ZyWALL&nbsp;Quagga/Zebra&nbsp;Remote&nbsp;Root&nbsp;Vulnerability
Release&nbsp;Date:&nbsp;10&nbsp;March&nbsp;2008
Discover:&nbsp;Pranav&nbsp;Joshi&nbsp;&lt;[email protected]&gt;
Vendor:&nbsp;ZyXEL
Products&nbsp;Affected:&nbsp;ZyWALL

(Status&nbsp;on&nbsp;other&nbsp;affected&nbsp;products&nbsp;&amp;&nbsp;firmwares&nbsp;pending&nbsp;from&nbsp;vendor’s&nbsp;end)

&nbsp;CVE-2008-1160

&nbsp;BID&nbsp;28184

---------------------------

Technical&nbsp;Details

---------------------------

The&nbsp;vulnerability&nbsp;in&nbsp;the&nbsp;Quagga/Zebra&nbsp;routing&nbsp;daemon,&nbsp;exists&nbsp;due&nbsp;to&nbsp;the&nbsp;
fact&nbsp;that&nbsp;the&nbsp;appliance&nbsp;fails&nbsp;to&nbsp;change&nbsp;the&nbsp;password&nbsp;needed&nbsp;to&nbsp;login&nbsp;
into&nbsp;the&nbsp;Quagga/Zebra&nbsp;daemon&nbsp;running&nbsp;on&nbsp;ports&nbsp;2601,&nbsp;2602&nbsp;(Quagga/RIP)&nbsp;&amp;&nbsp;
2604&nbsp;(Quagga/OSPF)&nbsp;/TCP,&nbsp;even&nbsp;though&nbsp;the&nbsp;password&nbsp;of&nbsp;the&nbsp;appliance&nbsp;has&nbsp;
been&nbsp;changed&nbsp;an&nbsp;attacker&nbsp;can&nbsp;still&nbsp;use&nbsp;the&nbsp;default&nbsp;password&nbsp;‘zebra’&nbsp;to&nbsp;
log&nbsp;into&nbsp;the&nbsp;Quagga/Zebra&nbsp;service&nbsp;to&nbsp;view&nbsp;and&nbsp;manipulate&nbsp;the&nbsp;routing&nbsp;
information&nbsp;etc.&nbsp;of&nbsp;the&nbsp;appliance.&nbsp;

The&nbsp;vulnerability&nbsp;was&nbsp;discovered&nbsp;on&nbsp;ZyWall&nbsp;1050&nbsp;appliance&nbsp;other&nbsp;versions&nbsp;
could&nbsp;be&nbsp;affected&nbsp;as&nbsp;well.&nbsp;

Information&nbsp;on&nbsp;other&nbsp;vulnerable&nbsp;products&nbsp;and&nbsp;firmwares&nbsp;is&nbsp;pending&nbsp;from&nbsp;
the&nbsp;vendor’s&nbsp;end.&nbsp;

22 Mar 2008 00:00Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.16288