CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2021-35032
https://notcve.org/view.php?id=CVE-2021-35032
28 Dec 2021 — A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands via a crafted function call. Una vulnerabilidad en el archivo "libsal.so" del firmware de la serie Zyxel GS1900 versión 2.60, podría permitir a un usuario local autenticado ejecutar comandos arbitrarios del sistema operativo por medio de una llamada de función diseñada • https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.0EPSS: 0%CPEs: 28EXPL: 0CVE-2021-35031
https://notcve.org/view.php?id=CVE-2021-35031
28 Dec 2021 — A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device. Una vulnerabilidad en el cliente TFTP del firmware de la serie Zyxel GS1900 versión 2.60, podría permitir a un usuario local autenticado ejecutar comandos arbitrarios del SO • https://www.zyxel.com/support/Zyxel_security_advisory_for_OS_command_injection_vulnerabilities_of_switches.shtml • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0CVE-2021-35030
https://notcve.org/view.php?id=CVE-2021-35030
26 Jul 2021 — A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet. Se ha encontrado una vulnerabilidad en el programa CGI de Zyxel GS1900-8 versión del firmware V2.60, que no esterilizaba apropiadamente el contenido de los paquetes y podía permitir a un usuario local autenticado llevar a cabo un ataque de tipo cross-site sc... • https://www.zyxel.com/support/Zyxel_security_advisory_for_XSS_vulnerability_of_GS1900_series_switches.shtml • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 18EXPL: 2CVE-2019-15799
https://notcve.org/view.php?id=CVE-2019-15799
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for al... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 3%CPEs: 18EXPL: 1CVE-2019-15800
https://notcve.org/view.php?id=CVE-2019-15800
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to fin... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15801
https://notcve.org/view.php?id=CVE-2019-15801
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0. Se descubrió un problema en los dispositivos Zyxel GS1900 con firmware ante... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-798: Use of Hard-coded Credentials •
CVSS: 5.9EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15802
https://notcve.org/view.php?id=CVE-2019-15802
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.1EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15803
https://notcve.org/view.php?id=CVE-2019-15803
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fds_sys_passDebugPasswd_ret(). The firmware contains access control checks that determine if remote users are allowed to access this functionality. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return T... • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 1CVE-2019-15804
https://notcve.org/view.php?id=CVE-2019-15804
14 Nov 2019 — An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application (e.g., through CTRL+\ via SSH). The access control check for this menu does work and prohibits accessing the menu, which contains "Password recovery for specific user" options. The menu is believed to be accessible using a serial console. • https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html •