PT-2008-3083 · Zyxel · Zyxel Prestige

Publicado

2008-03-26

·

Atualizado

2018-10-11

·

CVE-2008-1524

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions ZyXEL Prestige routers, including P-660 and P-661 models, versions 3.40(AGD.2) through 3.40(AHQ.3)
Description The issue concerns the default community string for SNMP services. The default string is set to "public" for both read and write operations, allowing remote attackers to perform administrative actions. This can be exploited to read sensitive information, such as the Dynamic DNS service password, or to insert malicious code, like an XSS sequence, into the system.sysName.0 variable, which is then displayed on the System Status page.
Recommendations For versions 3.40(AGD.2) through 3.40(AHQ.3), change the default community string for SNMP services to a secure, non-default value to prevent unauthorized access. Consider restricting access to SNMP services until the issue is fully resolved.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2008-1524

Produtos afetados

Zyxel Prestige