PT-2008-2853 · Zyxel · Zyxel P-2602Hw-D1A

Published 2008-03-10 · Updated 2018-10-11 · CVE-2008-1261

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel P-2602HW-D1A version 3.40(AJZ.1)

Description The issue allows remote attackers to determine the current login status by requesting an arbitrary admin URI, due to different responses provided by the router depending on whether a user is logged in.

Recommendations For Zyxel P-2602HW-D1A version 3.40(AJZ.1), consider restricting access to admin pages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2008-1261

Affected Products

Zyxel P-2602Hw-D1A

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-1261 · Security Note
• http://securityfocus.com/archive/1/489009/100/0/threaded · Note
• http://gnucitizen.org/projects/router-hacking-challenge · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41113 · Note