PT-2021-6109 · Zyxel · Zyxel Nbg6604

Published 2021-12-29 · Updated 2022-01-07 · CVE-2021-35034

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zyxel NBG6604 firmware (affected versions not specified)

Description The issue is related to an insufficient session expiration in the CGI program of the Zyxel NBG6604 firmware. This could allow a remote attacker to access the device if the correct token can be intercepted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2022-00847

CVE-2021-35034

Affected Products

Zyxel Nbg6604

References · 5

• https://zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35034 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00847 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-35034 · Security Note
• https://t.me/cibsecurity/34734 · Telegram Post