PT-2008-3086 · Zyxel · Zyxel Prestige

Publicado 2008-03-26 · Atualizado 2018-10-11 · CVE-2008-1527

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and versions 3.40(AGD.2) through 3.40(AHQ.3)

Description The issue allows remote attackers to obtain access via a replay attack, exploiting the authentication over HTTP via a hash string in the hiddenPassword field.

Recommendations For firmware versions 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), consider disabling the authentication over HTTP to minimize the risk of exploitation. Restrict access to the hiddenPassword field in the HTTP authentication process until a patch is available.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2008-1527

Produtos afetados

Zyxel Prestige

Referências · 4

• http://procheckup.com/Hacking_ZyXEL_Gateways.pdf · Nota
• http://securityfocus.com/archive/1/489009/100/0/threaded · Nota
• http://gnucitizen.org/projects/router-hacking-challenge · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1527 · Nota de Segurança