Privilege escalation in Zyxel Gs1900-10hp
CVE-2019-15799
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for all users on the device. As these passwords are encrypted using well-known and static parameters, they can be decrypted and the original passwords (including the administrator password) can be obtained.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.023 (83.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 83.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.023 · newest: 0.023 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html (Exploit, Third Party Advisory)
- vimeo.com/354726424 (Exploit, Third Party Advisory)
- www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-15799?
- CVE-2019-15799 is a high-severity vulnerability in Zyxel Gs1900-10hp, classified under Improper Privilege Management. CVSS score: 8.8/10. Published 2019-11-14.
- How severe is CVE-2019-15799?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2019-15799 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.