PT-2019-4286 · Zyxel · Zyxel Gs1900+1
Jasper Lievisse Adriaanse
·
Publicado
2019-11-14
·
Atualizado
2019-11-22
·
CVE-2019-15802
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0
Description
The issue exists due to the hardcoding of registration data in the
sal util str encrypt() function of the Zyxel GS1900 series router firmware. This allows a remote attacker to potentially disclose protected information. The firmware uses a hardcoded cryptographic key to hash and encrypt passwords, utilizing the sal util str encrypt() function in libsal.so.0.0. The parameters, including salt, IV, and key data, are used for AES256 encryption in CBC mode. With these parameters known, an attacker can decrypt all previously encrypted passwords, including those in configuration backups or embedded in the firmware.Recommendations
For Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0, update the firmware to version 2.50(AAHH.0)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to configuration backups and embedded firmware components that may contain encrypted passwords. Avoid using the
sal util str encrypt() function until a patch is available.Exploit
Correção
Using Hardcoded Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zyxel Gs1900
Libsal