CVE-2008-1523 Information disclosure in n/a

Medium 5.0 Published 26 Mar 2008 Updated 7 Aug 2024

Authenticated users can retrieve ISP and Dynamic DNS credentials by accessing specific HTML pages on ZyXEL Prestige routers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2008-1523?

CVE-2008-1523 is a medium-severity vulnerability in n/a, published on 26 Mar 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain ISP and Dynamic DNS credentials by sending a direct request for (1) WAN.html, (2) wzPPPOE.html, and (3) rpDyDNS.html, and then reading the HTML source.

Weakness: CWE-200

Which versions are affected by CVE-2008-1523?

It affects 3 products.

Products include Zyxel Prestige 660, Zyxel Prestige 661, Zyxel Zynos.

How do I fix CVE-2008-1523?

No fix has been published for CVE-2008-1523 yet. Limit exposure of the affected software until one is available.

Is CVE-2008-1523 being exploited?

There is no known exploitation of CVE-2008-1523 in the wild and no public exploit code.

Sources

Also known as GHSA-rhv5-x75f-g9rj.