Privilege escalation in Zyxel Gs1900-10hp
CVE-2019-15799
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for all users on the device. As these passwords are encrypted using well-known and static parameters, they can be decrypted and the original passwords (including the administrator password) can be obtained.
Vulnerability class: Privilege Escalation
EPSS: 0.023 (82.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-15799?
- CVE-2019-15799 is a high-severity vulnerability in Zyxel Gs1900-10hp, classified under Improper Privilege Management. CVSS score: 8.8/10. Published 2019-11-14.
- How severe is CVE-2019-15799?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2019-15799 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.