PT-2018-1453 · Zyxel · Zywall/Usg

Dennis Felsch · Published 2018-08-13 · Updated 2019-10-03 · CVE-2018-9129

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZyXEL ZyWALL/USG series devices (affected versions not specified)

Description The issue is related to a Bleichenbacher vulnerability in the Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections. This vulnerability is associated with errors in traffic decryption. Exploitation of the vulnerability may allow a remote attacker to access protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2018-01004

CVE-2018-9129

Affected Products

Zywall/Usg

References · 8

• https://bdu.fstec.ru/vul/2018-01004 · Security Note
• https://zyxel.com/support/bleichenbacher_attack_vulnerability.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9129 · Security Note
• https://web-in-security.blogspot.com/2018/08/practical-bleichenbacher-attacks-on-ipsec-ike.html · Note
• https://news.rambler.ru/internet/40559928-issledovateli-obnaruzhili-opasnye-uyazvimosti-v-protokole-ike · Note
• https://threatpost.ru/ike-bug-allows-authentication-bypass/27760 · Note
• ftp://ftp.zyxel.com/USG110/firmware/USG110_4.32%28AAPH.0%29C0_2.pdf · Note
• https://securitylab.ru/news/495058.php · Note