PT-2022-10387 · Zyxel · Zyxel Nwa-1100-Nh+1

M.Nageh · Published 2022-03-01 · Updated 2026-05-22 · CVE-2021-35036

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel VMG3625-T50B version V5.50(ABTL.0)b2k Zyxel NWA-1100-NH (affected versions not specified)

Description A vulnerability exists that could allow an attacker to obtain sensitive information or execute arbitrary OS commands on the device. The issue is related to cleartext storage of information in the configuration file and a command injection vulnerability in the web interface.

Recommendations For Zyxel VMG3625-T50B version V5.50(ABTL.0)b2k, consider updating the firmware to a version that addresses the cleartext storage issue. For Zyxel NWA-1100-NH, as a temporary workaround, consider restricting access to the web interface to minimize the risk of command injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-35036

Affected Products

Zyxel Nwa-1100-Nh

Zyxel Vmg3625-T50B

References · 6

• https://osv.dev/vulnerability/CVE-2021-35036 · Vendor Advisory
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-cleartext-storage-of-information-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35036 · Security Note
• https://t.me/RNetsec/23172 · Telegram Post
• https://t.me/cibsecurity/38251 · Telegram Post
• https://t.me/secharvester/22570 · Telegram Post