PT-2008-3086 · Zyxel · Zyxel Prestige

Published 2008-03-26 · Updated 2018-10-11 · CVE-2008-1527

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and versions 3.40(AGD.2) through 3.40(AHQ.3)

Description The issue allows remote attackers to obtain access via a replay attack, exploiting the authentication over HTTP via a hash string in the hiddenPassword field.

Recommendations For firmware versions 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), consider disabling the authentication over HTTP to minimize the risk of exploitation. Restrict access to the hiddenPassword field in the HTTP authentication process until a patch is available.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2008-1527

Affected Products

Zyxel Prestige

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-1527 · Security Note
• http://procheckup.com/Hacking_ZyXEL_Gateways.pdf · Note
• http://securityfocus.com/archive/1/489009/100/0/threaded · Note
• http://gnucitizen.org/projects/router-hacking-challenge · Note