CVE-2019-15802 Hardcoded credentials in n/a
Attackers can decrypt stored passwords using a hardcoded key, exposing credentials from configuration backups and firmware on Zyxel switches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15802?
CVE-2019-15802 is a medium-severity vulnerability in n/a, published on 14 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware.
Weakness: CWE-798
Which versions are affected by CVE-2019-15802?
It affects 9 products.
Products include Zyxel Gs1900-10hp Firmware, Zyxel Gs1900-16 Firmware, Zyxel Gs1900-24 Firmware, Zyxel Gs1900-24e Firmware, Zyxel Gs1900-24hp Firmware, Zyxel Gs1900-48 Firmware and 3 more.
How do I fix CVE-2019-15802?
No fix has been published for CVE-2019-15802 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15802 being exploited?
There is no known exploitation of CVE-2019-15802 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fmpq-8rp4-f234.