2024-09-10 04:03:16 +00:00
{
"id" : "CVE-2024-38270" ,
"sourceIdentifier" : "security@zyxel.com.tw" ,
"published" : "2024-09-10T02:15:09.780" ,
2024-09-18 20:03:19 +00:00
"lastModified" : "2024-09-18T18:23:40.977" ,
"vulnStatus" : "Analyzed" ,
2024-09-10 04:03:16 +00:00
"cveTags" : [ ] ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive."
2024-09-10 14:03:33 +00:00
} ,
{
"lang" : "es" ,
"value" : "Existe una vulnerabilidad de entrop\u00eda insuficiente causada por el uso indebido de una funci\u00f3n de aleatoriedad con baja entrop\u00eda para la generaci\u00f3n de tokens de autenticaci\u00f3n web en la versi\u00f3n de firmware V2.80(AAZI.0)C0 de Zyxel GS1900-10HP. Esta vulnerabilidad podr\u00eda permitir que un atacante basado en LAN tenga una peque\u00f1a posibilidad de obtener un token de sesi\u00f3n v\u00e1lido si hay varias sesiones autenticadas activas."
2024-09-10 04:03:16 +00:00
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
2024-12-08 03:06:42 +00:00
"source" : "security@zyxel.com.tw" ,
"type" : "Secondary" ,
2024-09-18 20:03:19 +00:00
"cvssData" : {
"version" : "3.1" ,
2024-12-08 03:06:42 +00:00
"vectorString" : "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" ,
"baseScore" : 5.3 ,
"baseSeverity" : "MEDIUM" ,
2024-09-18 20:03:19 +00:00
"attackVector" : "ADJACENT_NETWORK" ,
2024-12-08 03:06:42 +00:00
"attackComplexity" : "HIGH" ,
2024-09-18 20:03:19 +00:00
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "NONE" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2024-09-18 20:03:19 +00:00
} ,
2024-12-08 03:06:42 +00:00
"exploitabilityScore" : 1.6 ,
2024-09-18 20:03:19 +00:00
"impactScore" : 3.6
} ,
{
2024-12-08 03:06:42 +00:00
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
2024-09-10 04:03:16 +00:00
"cvssData" : {
"version" : "3.1" ,
2024-12-08 03:06:42 +00:00
"vectorString" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" ,
"baseScore" : 6.5 ,
"baseSeverity" : "MEDIUM" ,
2024-09-10 04:03:16 +00:00
"attackVector" : "ADJACENT_NETWORK" ,
2024-12-08 03:06:42 +00:00
"attackComplexity" : "LOW" ,
2024-09-10 04:03:16 +00:00
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "NONE" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2024-09-10 04:03:16 +00:00
} ,
2024-12-08 03:06:42 +00:00
"exploitabilityScore" : 2.8 ,
2024-09-10 04:03:16 +00:00
"impactScore" : 3.6
}
]
} ,
"weaknesses" : [
{
"source" : "security@zyxel.com.tw" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-331"
}
]
}
] ,
2024-09-18 20:03:19 +00:00
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-48hpv2_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "2.80\\(abtq.1\\)c0" ,
"matchCriteriaId" : "ACACFF77-1C3D-4DBA-A179-500B5602ED46"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-48hpv2:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "BC74C679-6D22-47E4-AE8A-2647B1AA4276"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "2.80\\(aahn.1\\)c0" ,
"matchCriteriaId" : "7F2E6F4E-9DA0-4AFB-B4A3-7C3E611DA2FA"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-48:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CFB7D4BF-7D17-48D3-990D-4BADAC8BD868"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-24hpv2_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "2.80\\(abtp.1\\)c0" ,
"matchCriteriaId" : "B3539C1D-6C16-4DFB-A601-F5346071F4D7"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-24hpv2:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "512D9A91-8DA7-47F1-AC77-AF743F99BFF3"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-24ep_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "2.80\\(abto.1\\)c0" ,
"matchCriteriaId" : "FF16626B-7BBE-4BFF-A60E-02B0B1243217"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-24ep:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B22AA8B1-11E2-408F-A1F6-0F8AF32AB131"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2.80\\(aahk.1\\)c0" ,
"matchCriteriaId" : "F8AE67A4-4CCE-4E95-840D-CB6F4F6FB00F"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-24e:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A6456AD6-8A1D-4D3D-AC1A-ABE442242B1B"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2.80\\(aahl.1\\)c0" ,
"matchCriteriaId" : "441A359C-A00E-4B96-A321-F769259871B7"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-24:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F4F55299-70D5-4CE1-A1EC-D79B469B94F7"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "2.80\\(aahj.1\\)c0" ,
"matchCriteriaId" : "A657FCE5-BA80-4E22-934A-3B632A9200D7"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-16:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "5078F7A5-D03B-4D3A-9C19-57DFF4D6BF7A"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "2.80\\(aazi.1\\)c0" ,
"matchCriteriaId" : "4503BD65-51A5-4626-9076-021E6F7DF0B8"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-10hp:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "89201505-07AF-4F9C-9304-46F2707DB9B4"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "2.80\\(aahi.1\\)c0" ,
"matchCriteriaId" : "96F5E646-4DFD-4476-9D8B-9A8919C1F261"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-8hp:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "27602862-EFB7-402B-994E-254A0B210820"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "2.80\\(aahh.1\\)c0" ,
"matchCriteriaId" : "87482A53-9933-4A0B-9831-F16AF9CBFB46"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:zyxel:gs1900-8:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "51D33F50-B5A4-4AEF-972C-7FF089C21D52"
}
]
}
]
}
] ,
2024-09-10 04:03:16 +00:00
"references" : [
{
"url" : "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-for-web-authentication-tokens-generation-in-gs1900-series-switches-09-10-2024" ,
2024-09-18 20:03:19 +00:00
"source" : "security@zyxel.com.tw" ,
"tags" : [
"Vendor Advisory"
]
2024-09-10 04:03:16 +00:00
}
]
}
