CVE-2018-9129 Weak cryptography in n/a
Attackers can exploit a Bleichenbacher vulnerability in the IKE handshake to decrypt IPsec VPN traffic or bypass authentication on ZyXEL firewalls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-9129?
CVE-2018-9129 is a medium-severity vulnerability in n/a, published on 15 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.
Which versions are affected by CVE-2018-9129?
It affects 17 products.
Products include Zyxel Usg 1100 Firmware, Zyxel Usg 110 Firmware, Zyxel Usg 1900 Firmware, Zyxel Usg 20w-Vpn Firmware, Zyxel Usg 20w Firmware, Zyxel Usg 2200-Vpn Firmware and 11 more.
How do I fix CVE-2018-9129?
No fix has been published for CVE-2018-9129 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-9129 being exploited?
There is no known exploitation of CVE-2018-9129 in the wild and no public exploit code.
Sources
Also known as GHSA-rxgc-f7rc-pv6h.