Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
May 30, 2023The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an aCVE-2022-45853 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 6.7
The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an authenticated, local attacker with administrator privileges to execute some system commands as 'root' on a vulnerable device via SSH.
- Product
- GS1900-8HP firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenCVE-2021-35030 · Network & remote access · Zyxel · reported by security@zyxel.com.twLow 3.5
A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet.
- Product
- GS1900-8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0.CVE-2019-15804 · Network & remote access · Zyxel · reported by MITREHigh 7.5
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application (e.g., through CTRL+\ via SSH). The access control check for this menu does work and prohibits accessing the menu, which contains "Password recovery for specific user" options. The menu is believed to be accessible using a serial console.
- Product
- Gs1900-8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0.CVE-2019-15803 · Network & remote access · Zyxel · reported by MITRECritical 9.1
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fds_sys_passDebugPasswd_ret(). The firmware contains access control checks that determine if remote users are allowed to access this functionality. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return TRUE with no actual checks performed. The diagnostics menu allows for reading/writing arbitrary registers and various other configuration parameters which are believed to be related to the network interface chips.
- Product
- Gs1900-8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0.CVE-2019-15802 · Network & remote access · Zyxel · reported by MITREMedium 5.9
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware.
- Product
- Gs1900-8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0.CVE-2019-15801 · Network & remote access · Zyxel · reported by MITREHigh 7.5
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0.
- Product
- Gs1900-8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0.CVE-2019-15800 · Network & remote access · Zyxel · reported by MITRECritical 9.8
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to finally use these vulnerabilities to gain code execution.)
- Product
- Gs1900-8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0.CVE-2019-15799 · Network & remote access · Zyxel · reported by MITREHigh 8.8
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for all users on the device. As these passwords are encrypted using well-known and static parameters, they can be decrypted and the original passwords (including the administrator password) can be obtained.
- Product
- Gs1900-8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.