PT-2021-20002 · Zyxel · Zyxel Nbg2105

Published 2021-01-26 · Updated 2025-11-25 · CVE-2021-3297

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel NBG2105 version 1.00(AAGU.2)C0

Description The issue allows for administrator access by setting the login cookie to 1.

Recommendations For Zyxel NBG2105 version 1.00(AAGU.2)C0, consider restricting access to the login functionality until a patch is available. Avoid using the login cookie as a means of authentication until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-3297

Affected Products

Zyxel Nbg2105

References · 9

• 🔥❌ https://github.com/Sec504/Zyxel-NBG2105-CVE-2021-3297 · Exploit, Deleted
• 🔥 https://github.com/nieldk/vulnerabilities/blob/main/zyxel%20nbg2105/Admin%20bypass · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3297 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3297 · Vendor Advisory
• https://zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01490&md=NBG2105 · Vendor Advisory
• https://zyxel.com/us/en/support/security_advisories.shtml · Vendor Advisory
• https://codeberg.org/nieldk/vulnerabilities/src/branch/main/zyxel%20nbg2105/Admin%20bypass · Note
• https://t.me/cveNotify/143985 · Telegram Post
• https://t.me/cybersecuritytechnologies/3099 · Telegram Post