PT-2019-4110 · Zyxel · Zyxel Gs1900

Jasper Lievisse Adriaanse · Publicado 2019-11-14 · Atualizado 2019-11-21 · CVE-2019-15799

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0

Description An issue allows user accounts with non-admin level privileges to have the same level of privileged access as administrators when connecting to the device via SSH. This enables normal users to obtain the administrative password by running the tech-support command via the CLI, which contains the encrypted passwords for all users on the device. These passwords can be decrypted as they are encrypted using well-known and static parameters, allowing the original passwords, including the administrator password, to be obtained.

Recommendations For Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0, update the firmware to version 2.50(AAHH.0)C0 or later to resolve the issue. As a temporary workaround, consider restricting SSH access to only administrative accounts until the firmware can be updated.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2019-04681

CVE-2019-15799

Produtos afetados

Zyxel Gs1900

Referências · 6

• 🔥 https://vimeo.com/354726424 · Exploit
• 🔥 https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html · Exploit
• https://bdu.fstec.ru/vul/2019-04681 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-15799 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15799 · Aviso do Fabricante
• https://zyxel.com/support/gs1900-switch-vulnerabilities.shtml · Aviso do Fabricante