PT-2008-1001 · Quagga+1 · Quagga+3
Pranav Joshi
·
Publicado
2008-03-24
·
Atualizado
2024-02-14
·
CVE-2008-1160
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
ZyXEL ZyWALL 1050 (affected versions not specified)
ZyXEL ZyWALL USG 300 (affected versions not specified)
Description
The issue is related to a hard-coded password for the Quagga and Zebra processes in the ZyXEL ZyWALL firewall/router operating system. This password is not changed when a user sets a new password, allowing remote attackers to gain privileges by using the old password. The Quagga and Zebra processes continue to respond to requests formed with the old password.
Recommendations
For ZyXEL ZyWALL 1050, consider disabling the Quagga and Zebra processes until a patch is available to prevent remote attackers from gaining privileges.
For ZyXEL ZyWALL USG 300, restrict access to the system to minimize the risk of exploitation by remote attackers using the old password.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Using Hardcoded Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Quagga
Zebra
Zywall 1050
Zywall Usg 300