CVE-2019-15799
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for all users on the device. As these passwords are encrypted using well-known and static parameters, they can be decrypted and the original passwords (including the administrator password) can be obtained.
Se descubrió un problema en los dispositivos Zyxel GS1900 con firmware anterior a la versión 2.50 (AAHH.0) C0. Las cuentas de usuario creadas a través de la interfaz web del dispositivo, cuando se les otorgan privilegios de nivel no administrativo, tienen el mismo nivel de acceso privilegiado que los administradores cuando se conectan al dispositivo a través de SSH (mientras que sus permisos a través de la interfaz web están de hecho restringidos). Esto permite a los usuarios normales obtener la contraseña administrativa ejecutando el comando de soporte técnico a través de la CLI: contiene las contraseñas cifradas para todos los usuarios en el dispositivo. Como estas contraseñas se cifran con parámetros conocidos y estáticos, se pueden descifrar y se pueden obtener las contraseñas originales (incluida la contraseña del administrador).
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-08-29 CVE Reserved
- 2019-11-14 CVE Published
- 2023-08-01 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html | 2024-08-05 | |
| https://vimeo.com/354726424 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml | 2019-11-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Zyxel Search vendor "Zyxel" | Gs1900-8 Firmware Search vendor "Zyxel" for product "Gs1900-8 Firmware" | < 2.50\(aahh.0\)c0 Search vendor "Zyxel" for product "Gs1900-8 Firmware" and version " < 2.50\(aahh.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-8 Search vendor "Zyxel" for product "Gs1900-8" | - | - |
Safe
|
| Zyxel Search vendor "Zyxel" | Gs1900-8hp Firmware Search vendor "Zyxel" for product "Gs1900-8hp Firmware" | < 2.50\(aahi.0\)c0 Search vendor "Zyxel" for product "Gs1900-8hp Firmware" and version " < 2.50\(aahi.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-8hp Search vendor "Zyxel" for product "Gs1900-8hp" | - | - |
Safe
|
| Zyxel Search vendor "Zyxel" | Gs1900-10hp Firmware Search vendor "Zyxel" for product "Gs1900-10hp Firmware" | < 2.50\(aazi.0\)c0 Search vendor "Zyxel" for product "Gs1900-10hp Firmware" and version " < 2.50\(aazi.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-10hp Search vendor "Zyxel" for product "Gs1900-10hp" | - | - |
Safe
|
| Zyxel Search vendor "Zyxel" | Gs1900-16 Firmware Search vendor "Zyxel" for product "Gs1900-16 Firmware" | < 2.50\(aahj.0\)c0 Search vendor "Zyxel" for product "Gs1900-16 Firmware" and version " < 2.50\(aahj.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-16 Search vendor "Zyxel" for product "Gs1900-16" | - | - |
Safe
|
| Zyxel Search vendor "Zyxel" | Gs1900-24e Firmware Search vendor "Zyxel" for product "Gs1900-24e Firmware" | < 2.50\(aahk.0\)c0 Search vendor "Zyxel" for product "Gs1900-24e Firmware" and version " < 2.50\(aahk.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-24e Search vendor "Zyxel" for product "Gs1900-24e" | - | - |
Safe
|
| Zyxel Search vendor "Zyxel" | Gs1900-24 Firmware Search vendor "Zyxel" for product "Gs1900-24 Firmware" | < 2.50\(aahl.0\)c0 Search vendor "Zyxel" for product "Gs1900-24 Firmware" and version " < 2.50\(aahl.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-24 Search vendor "Zyxel" for product "Gs1900-24" | - | - |
Safe
|
| Zyxel Search vendor "Zyxel" | Gs1900-24hp Firmware Search vendor "Zyxel" for product "Gs1900-24hp Firmware" | < 2.50\(aahm.0\)c0 Search vendor "Zyxel" for product "Gs1900-24hp Firmware" and version " < 2.50\(aahm.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-24hp Search vendor "Zyxel" for product "Gs1900-24hp" | - | - |
Safe
|
| Zyxel Search vendor "Zyxel" | Gs1900-48 Firmware Search vendor "Zyxel" for product "Gs1900-48 Firmware" | < 2.50\(aahn.0\)c0 Search vendor "Zyxel" for product "Gs1900-48 Firmware" and version " < 2.50\(aahn.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-48 Search vendor "Zyxel" for product "Gs1900-48" | - | - |
Safe
|
| Zyxel Search vendor "Zyxel" | Gs1900-48hp Firmware Search vendor "Zyxel" for product "Gs1900-48hp Firmware" | < 2.50\(aaho.0\)c0 Search vendor "Zyxel" for product "Gs1900-48hp Firmware" and version " < 2.50\(aaho.0\)c0" | - |
Affected
| in | Zyxel Search vendor "Zyxel" | Gs1900-48hp Search vendor "Zyxel" for product "Gs1900-48hp" | - | - |
Safe
|