PT-2008-1001 · Quagga+1 · Quagga+3

Pranav Joshi

·

Published

2008-03-24

·

Updated

2024-02-14

·

CVE-2008-1160

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions ZyXEL ZyWALL 1050 (affected versions not specified) ZyXEL ZyWALL USG 300 (affected versions not specified)
Description The issue is related to a hard-coded password for the Quagga and Zebra processes in the ZyXEL ZyWALL firewall/router operating system. This password is not changed when a user sets a new password, allowing remote attackers to gain privileges by using the old password. The Quagga and Zebra processes continue to respond to requests formed with the old password.
Recommendations For ZyXEL ZyWALL 1050, consider disabling the Quagga and Zebra processes until a patch is available to prevent remote attackers from gaining privileges. For ZyXEL ZyWALL USG 300, restrict access to the system to minimize the risk of exploitation by remote attackers using the old password. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798CWE-259

Related Identifiers

BDU:2014-00048
CVE-2008-1160

Affected Products

Quagga
Zebra
Zywall 1050
Zywall Usg 300