PT-2019-4286 · Zyxel · Zyxel Gs1900+1

Jasper Lievisse Adriaanse · Published 2019-11-14 · Updated 2019-11-22 · CVE-2019-15802

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0

Description The issue exists due to the hardcoding of registration data in the sal util str encrypt() function of the Zyxel GS1900 series router firmware. This allows a remote attacker to potentially disclose protected information. The firmware uses a hardcoded cryptographic key to hash and encrypt passwords, utilizing the sal util str encrypt() function in libsal.so.0.0. The parameters, including salt, IV, and key data, are used for AES256 encryption in CBC mode. With these parameters known, an attacker can decrypt all previously encrypted passwords, including those in configuration backups or embedded in the firmware.

Recommendations For Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0, update the firmware to version 2.50(AAHH.0)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to configuration backups and embedded firmware components that may contain encrypted passwords. Avoid using the sal util str encrypt() function until a patch is available.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2020-00001

CVE-2019-15802

Affected Products

Zyxel Gs1900

Libsal

References · 6

• 🔥 https://github.com/jasperla/CVE-2019-15802 · Exploit
• 🔥 https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-15802 · Vendor Advisory
• https://zyxel.com/support/gs1900-switch-vulnerabilities.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15802 · Security Note
• https://bdu.fstec.ru/vul/2020-00001 · Security Note