PT-2021-6108 · Zyxel · Zyxel Gs1900 Series

Published 2021-12-28 · Updated 2022-01-07 · CVE-2021-35032

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 series firmware version 2.60

Description A vulnerability in the 'libsal.so' file of the Zyxel GS1900 series firmware could allow an authenticated local user to execute arbitrary OS commands via a crafted function call. The issue is related to the failure to neutralize special elements, which can be exploited through the graphical interface.

Recommendations For Zyxel GS1900 series firmware version 2.60, consider restricting access to the libsal.so file as a temporary workaround until a patch is available. Additionally, limit the use of the graphical interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-00846

CVE-2021-35032

Affected Products

Zyxel Gs1900 Series

References · 5

• https://bdu.fstec.ru/vul/2022-00846 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35032 · Security Note
• https://zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml · Vendor Advisory
• https://zyxel.com/ru/ru/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml · Note