Vulnerability Details : CVE-2019-15802
Potential exploit
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware.
Products affected by CVE-2019-15802
- cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:gs1900-24hp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:zyxel:gs1900-48hp_firmware:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-15802
0.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 49 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-15802
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2019-15802
-
The product contains hard-coded credentials, such as a password or cryptographic key.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-15802
-
https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml
Zyxel security advisory for GS1900 switch vulnerabilities | ZyxelVendor Advisory
-
https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html
Exploring Zyxel GS1900 firmware with Ghidra - [ jasper.la ]Exploit;Third Party Advisory
Jump to