{ "id": "CVE-2019-15803", "sourceIdentifier": "cve@mitre.org", "published": "2019-11-14T21:15:11.890", "lastModified": "2020-08-24T17:37:01.140", "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fds_sys_passDebugPasswd_ret(). The firmware contains access control checks that determine if remote users are allowed to access this functionality. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return TRUE with no actual checks performed. The diagnostics menu allows for reading/writing arbitrary registers and various other configuration parameters which are believed to be related to the network interface chips." }, { "lang": "es", "value": "Se descubri\u00f3 un problema en los dispositivos Zyxel GS1900 con firmware anterior a la versi\u00f3n 2.50 (AAHH.0) C0. A trav\u00e9s de una secuencia indocumentada de pulsaciones de teclas, se activa la funcionalidad no documentada. Se activa un shell de diagn\u00f3stico a trav\u00e9s de CTRL-ALT-t, que solicita la contrase\u00f1a devuelta por fds_sys_passDebugPasswd_ret (). El firmware contiene comprobaciones de control de acceso que determinan si los usuarios remotos pueden acceder a esta funcionalidad. La funci\u00f3n que realiza esta comprobaci\u00f3n (fds_sys_remoteDebugEnable_ret en libfds.so) siempre devuelve VERDADERO sin realizar comprobaciones reales. El men\u00fa de diagn\u00f3stico permite leer / escribir registros arbitrarios y varios otros par\u00e1metros de configuraci\u00f3n que se cree que est\u00e1n relacionados con los chips de la interfaz de red." } ], "metrics": { "cvssMetricV31": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } ], "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "NONE", "baseScore": 6.4 }, "baseSeverity": "MEDIUM", "exploitabilityScore": 10.0, "impactScore": 4.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-287" } ] } ], "configurations": [ { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aahh.0\\)c0", "matchCriteriaId": "B5428A26-563D-47A7-A771-D6F20775EDF5" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-8:-:*:*:*:*:*:*:*", "matchCriteriaId": "51D33F50-B5A4-4AEF-972C-7FF089C21D52" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aahi.0\\)c0", "matchCriteriaId": "0E6DB241-5659-414E-856E-C5D790D07F8B" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-8hp:-:*:*:*:*:*:*:*", "matchCriteriaId": "27602862-EFB7-402B-994E-254A0B210820" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aazi.0\\)c0", "matchCriteriaId": "21D9999F-C55E-4BAB-A401-007FB34B2A5E" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-10hp:-:*:*:*:*:*:*:*", "matchCriteriaId": "89201505-07AF-4F9C-9304-46F2707DB9B4" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aahj.0\\)c0", "matchCriteriaId": "52D51F8F-8BCB-4571-A782-264B71C7CD76" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-16:-:*:*:*:*:*:*:*", "matchCriteriaId": "5078F7A5-D03B-4D3A-9C19-57DFF4D6BF7A" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aahk.0\\)c0", "matchCriteriaId": "3687A400-9D7F-453A-88D7-C87B85B6E4EB" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-24e:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6456AD6-8A1D-4D3D-AC1A-ABE442242B1B" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aahl.0\\)c0", "matchCriteriaId": "6733BECF-F9A3-4748-8A96-DFB10A670C35" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-24:-:*:*:*:*:*:*:*", "matchCriteriaId": "F4F55299-70D5-4CE1-A1EC-D79B469B94F7" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-24hp_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aahm.0\\)c0", "matchCriteriaId": "5D3A3C5E-2027-40EE-A9EF-983474E9DC07" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-24hp:-:*:*:*:*:*:*:*", "matchCriteriaId": "74B1D264-99AC-4AA8-955C-602F2DA5B885" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aahn.0\\)c0", "matchCriteriaId": "45D88D78-F7C9-45BB-8E47-2BD24B8616B2" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-48:-:*:*:*:*:*:*:*", "matchCriteriaId": "CFB7D4BF-7D17-48D3-990D-4BADAC8BD868" } ] } ] }, { "operator": "AND", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:zyxel:gs1900-48hp_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.50\\(aaho.0\\)c0", "matchCriteriaId": "C6EA6D9E-B5D4-4043-90C5-409B5875A3B5" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:h:zyxel:gs1900-48hp:-:*:*:*:*:*:*:*", "matchCriteriaId": "566A9E8C-AF55-4331-B9B0-F65EB900B0BE" } ] } ] } ], "references": [ { "url": "https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html", "source": "cve@mitre.org", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml", "source": "cve@mitre.org", "tags": [ "Vendor Advisory" ] } ] }