Vulnerability in Zyxel Gs1900-10hp
CVE-2019-15804
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application (e.g., through CTRL+\ via SSH). The access control check for this menu does work and prohibits accessing the menu, which contains "Password recovery for specific user" options. The menu is believed to be accessible using a serial console.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.009 (60.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
References
- jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html (Exploit, Third Party Advisory)
- www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-15804?
- CVE-2019-15804 is a high-severity vulnerability in Zyxel Gs1900-10hp. CVSS score: 7.5/10. Published 2019-11-14.
- How severe is CVE-2019-15804?
- High severity. CVSS v3 base score is 7.5 out of 10.