CVE-2021-35033
23.11.2021, 22:15
A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.Enginsight
| Vendor | Product | Version |
|---|---|---|
| zyxel | nbg6818_firmware | 𝑥 < 1.00\(absc.5\)c0 |
| zyxel | nbg7815_firmware | 𝑥 < 1.00\(absk.7\)c0 |
| zyxel | wsq20_firmware | 𝑥 < 1.00\(abof.11\)c0 |
| zyxel | wsq50_firmware | 𝑥 < 2.20\(abkj.7\)c0 |
| zyxel | wsq60_firmware | 𝑥 < 2.20\(abnd.8\)c0 |
| zyxel | wsr30_firmware | 𝑥 < 1.00\(abmy.12\)c0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-260 - Password in Configuration FileThe software stores a password in a configuration file that might be accessible to actors who do not know the password.
- CWE-287 - Improper AuthenticationWhen an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
References