PT-2019-4087 · Zyxel · Libfds.So.0.0+1

Jasper Lievisse Adriaanse · Published 2019-11-14 · Updated 2021-07-21 · CVE-2019-15801

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0

Description The issue is related to insufficient protection of registration data in the functions fds sys passDebugPasswd ret() and fds sys passRecoveryPasswd ret() of the libfds.so.0.0 library in Zyxel GS1900 series router firmware. This can allow a remote attacker to elevate their privileges. The firmware image contains encrypted passwords used for authentication to access diagnostics or password-recovery menus, which can be decrypted using a hardcoded cryptographic key found in the firmware.

Recommendations For Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0, update the firmware to version 2.50(AAHH.0)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the diagnostics and password-recovery menus to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Using Hardcoded Credentials

Weakness Enumeration

CWE-522

CWE-798

Related Identifiers

BDU:2019-04655

CVE-2019-15801

Affected Products

Zyxel Gs1900

Libfds.So.0.0

References · 5

• 🔥 https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15801 · Security Note
• https://zyxel.com/support/gs1900-switch-vulnerabilities.shtml · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04655 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15801 · Vendor Advisory