PT-2017-3099 · Zyxel · Zyxel Wre6505

Published 2017-04-16 · Updated 2019-10-03 · CVE-2017-7964

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel WRE6505 devices (affected versions not specified)

Description The issue concerns the use of default credentials for the root and admin accounts, with a default password of 1234, making it easier for remote attackers to conduct DNS hijacking attacks. This is achieved by reconfiguring the built-in dnshijacker process. The default TELNET password allows attackers to exploit this issue and intercept DNS requests.

Recommendations For Zyxel WRE6505 devices, change the default password for the root and admin accounts to prevent unauthorized access via TELNET. As a temporary workaround, consider disabling the TELNET protocol until a secure configuration or patch is available. Restrict access to the dnshijacker process to minimize the risk of DNS hijacking attacks.

Exploit

Fix

Weakness Enumeration

CWE-255

CWE-1188

Related Identifiers

BDU:2017-02479

CVE-2017-7964

Affected Products

Zyxel Wre6505

References · 4

• 🔥 https://oxy-gen.mobi/blog.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-7964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7964 · Security Note
• https://bdu.fstec.ru/vul/2017-02479 · Security Note