CVE-2019-15804 : An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI proc

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application (e.g., through CTRL+\ via SSH). The access control check for this menu does work and prohibits accessing the menu, which contains "Password recovery for specific user" options. The menu is believed to be accessible using a serial console.

Published 2019-11-14 21:15:12

Updated 2020-08-24 17:37:01

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-15804

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 45 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-15804

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

References for CVE-2019-15804

Products affected by CVE-2019-15804

Zyxel » Gs1900-8 Firmware
Versions before (<) 2.50\(aahh.0\)c0
cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-8 » Version: N/A
Zyxel » Gs1900-24 Firmware
Versions before (<) 2.50\(aahl.0\)c0
cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-24 » Version: N/A
Zyxel » Gs1900-8hp Firmware
Versions before (<) 2.50\(aahi.0\)c0
cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-8hp » Version: N/A
Zyxel » Gs1900-10hp Firmware
Versions before (<) 2.50\(aazi.0\)c0
cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-10hp » Version: N/A
Zyxel » Gs1900-16 Firmware
Versions before (<) 2.50\(aahj.0\)c0
cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-16 » Version: N/A
Zyxel » Gs1900-24e Firmware
Versions before (<) 2.50\(aahk.0\)c0
cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-24e » Version: N/A
Zyxel » Gs1900-24hp Firmware
Versions before (<) 2.50\(aahm.0\)c0
cpe:2.3:o:zyxel:gs1900-24hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-24hp » Version: N/A
Zyxel » Gs1900-48 Firmware
Versions before (<) 2.50\(aahn.0\)c0
cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-48 » Version: N/A
Zyxel » Gs1900-48hp Firmware
Versions before (<) 2.50\(aaho.0\)c0
cpe:2.3:o:zyxel:gs1900-48hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-48hp » Version: N/A

Vulnerability Details : CVE-2019-15804

Exploit prediction scoring system (EPSS) score for CVE-2019-15804

CVSS scores for CVE-2019-15804

References for CVE-2019-15804

Products affected by CVE-2019-15804