HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2021-35033

CVSS 7.8v3.1pub. 2021-11-23upd. 2024-11-21

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Zyxel Nbg6818

    HW
    Zyxel
    all versions

  • Zyxel Nbg6818 Firmware

    OS
    Zyxel
    < 1.00\(absc.5\)c0

  • Zyxel Nbg7815

    HW
    Zyxel
    all versions

  • Zyxel Nbg7815 Firmware

    OS
    Zyxel
    < 1.00\(absk.7\)c0

  • Zyxel Wsq20

    HW
    Zyxel
    all versions

  • Zyxel Wsq20 Firmware

    OS
    Zyxel
    < 1.00\(abof.11\)c0

  • Zyxel Wsq50

    HW
    Zyxel
    all versions

  • Zyxel Wsq50 Firmware

    OS
    Zyxel
    < 2.20\(abkj.7\)c0

  • Zyxel Wsq60

    HW
    Zyxel
    all versions

  • Zyxel Wsq60 Firmware

    OS
    Zyxel
    < 2.20\(abnd.8\)c0

  • Zyxel Wsr30

    HW
    Zyxel
    all versions

  • Zyxel Wsr30 Firmware

    OS
    Zyxel
    < 1.00\(abmy.12\)c0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2023-27992CRITICAL9.8⚠ KEVPL ✓same vendor

Zyxel NAS — pre-authentication command injection w firmware NAS326/540/542

CVE-2023-33010CRITICAL9.8⚠ KEVPL ✓same vendor

Buffer overflow w firmware Zyxel — RCE bez uwierzytelnienia (firewalle/VPN)

CVE-2023-33009CRITICAL9.8⚠ KEVPL ✓same vendor

Buffer overflow w firmware Zyxel — RCE bez uwierzytelnienia

CVE-2023-28771CRITICAL9.8⚠ KEVPL ✓same vendor

Zyxel Firewall/VPN — zdalny command injection bez uwierzytelnienia (RCE)

CVE-2022-30525CRITICAL9.8⚠ KEVPL ✓same vendor

Command injection w firmware Zyxel USG FLEX i VPN — zdalne wykonanie poleceń OS