CVSS: 9.0EPSS: 1%CPEs: 18EXPL: 2CVE-2019-15799
https://notcve.org/view.php?id=CVE-2019-15799
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for all users on the device. As these passwords are encrypted using well-known and static parameters, they can be decrypted and the original passwords (including the administrator password) can be obtained. Se descubrió un problema en los dispositivos Zyxel GS1900 con firmware anterior a la versión 2.50 (AAHH.0) C0. • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html https://vimeo.com/354726424 https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15800
https://notcve.org/view.php?id=CVE-2019-15800
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to finally use these vulnerabilities to gain code execution.) Se descubrió un problema en los dispositivos Zyxel GS1900 con firmware anterior a 2.50 (AAHH.0) C0. Debido a la falta de validación de entrada en las funciones cmd_sys_traceroute_exec (), cmd_sys_arp_clear () y cmd_sys_ping_exec () en la biblioteca libclicmd.so contenida en el firmware, un atacante podría aprovechar estas funciones para llamar al sistema () y ejecutar comandos arbitrarios en los conmutadores . • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15801
https://notcve.org/view.php?id=CVE-2019-15801
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0. Se descubrió un problema en los dispositivos Zyxel GS1900 con firmware anterior a la versión 2.50 (AAHH.0) C0. • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml • CWE-798: Use of Hard-coded Credentials •
CVSS: 5.9EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15802
https://notcve.org/view.php?id=CVE-2019-15802
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware. • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.1EPSS: 1%CPEs: 18EXPL: 1CVE-2019-15803
https://notcve.org/view.php?id=CVE-2019-15803
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fds_sys_passDebugPasswd_ret(). The firmware contains access control checks that determine if remote users are allowed to access this functionality. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return TRUE with no actual checks performed. • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml • CWE-287: Improper Authentication •