CVSS: 5.5EPSS: 0%CPEs: 20EXPL: 0CVE-2023-35140
https://notcve.org/view.php?id=CVE-2023-35140
07 Nov 2023 — The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device. La vulnerabilidad de administración de privilegios inadecuada en Zyxel GS1900-24EP switch firmware versión V2.70 (ABTO.5) podría permitir que un usuario local autenticado con acceso de solo lectura modifique la configuración del sistema en un dispositivo vulnerable. The improper privilege... • https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-gs1900-series-switches • CWE-269: Improper Privilege Management •
CVSS: 5.9EPSS: 0%CPEs: 20EXPL: 0CVE-2022-34746
https://notcve.org/view.php?id=CVE-2022-34746
20 Sep 2022 — An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface. Se ha encontrado una vulnerabilidad de entropía insuficiente causada por el uso inapropiado de fuentes de aleatoriedad con baja entropía para... • https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-of-gs1900-series-switches • CWE-331: Insufficient Entropy •
CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2021-35032
https://notcve.org/view.php?id=CVE-2021-35032
28 Dec 2021 — A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands via a crafted function call. Una vulnerabilidad en el archivo "libsal.so" del firmware de la serie Zyxel GS1900 versión 2.60, podría permitir a un usuario local autenticado ejecutar comandos arbitrarios del sistema operativo por medio de una llamada de función diseñada • https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.0EPSS: 0%CPEs: 28EXPL: 0CVE-2021-35031
https://notcve.org/view.php?id=CVE-2021-35031
28 Dec 2021 — A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device. Una vulnerabilidad en el cliente TFTP del firmware de la serie Zyxel GS1900 versión 2.60, podría permitir a un usuario local autenticado ejecutar comandos arbitrarios del SO • https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0CVE-2021-35030
https://notcve.org/view.php?id=CVE-2021-35030
26 Jul 2021 — A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet. Se ha encontrado una vulnerabilidad en el programa CGI de Zyxel GS1900-8 versión del firmware V2.60, que no esterilizaba apropiadamente el contenido de los paquetes y podía permitir a un usuario local autenticado llevar a cabo un ataque de tipo cross-site sc... • https://www.zyxel.com/support/Zyxel_security_advisory_for_XSS_vulnerability_of_GS1900_series_switches.shtml • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 2%CPEs: 18EXPL: 2CVE-2019-15799
https://notcve.org/view.php?id=CVE-2019-15799
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for al... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15800
https://notcve.org/view.php?id=CVE-2019-15800
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to fin... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15801
https://notcve.org/view.php?id=CVE-2019-15801
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0. Se descubrió un problema en los dispositivos Zyxel GS1900 con firmware ante... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-798: Use of Hard-coded Credentials •
CVSS: 5.9EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15802
https://notcve.org/view.php?id=CVE-2019-15802
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.1EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15803
https://notcve.org/view.php?id=CVE-2019-15803
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fds_sys_passDebugPasswd_ret(). The firmware contains access control checks that determine if remote users are allowed to access this functionality. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return T... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-287: Improper Authentication •