What is CVE-2021-35031?

CVE-2021-35031 is a medium-severity vulnerability in Zyxel Gs1900-10hp, classified under OS Command Injection. CVSS score: 6.8/10. Published 2021-12-28.

How severe is CVE-2021-35031?

Medium severity. CVSS v3 base score is 6.8 out of 10.

RCE in Zyxel Gs1900-10hp

CVE-2021-35031

A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.005 (37.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Zyxel Gs1900-10hp
Zyxel Gs1900-10hp_firmware
Zyxel Gs1900-16
Zyxel Gs1900-16_firmware
Zyxel Gs1900-24
Zyxel Gs1900-24e
Zyxel Gs1900-24e_firmware
Zyxel Gs1900-24ep
Zyxel Gs1900-24ep_firmware
Zyxel Gs1900-24_firmware

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security@zyxel.com.tw (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2021-35031?: CVE-2021-35031 is a medium-severity vulnerability in Zyxel Gs1900-10hp, classified under OS Command Injection. CVSS score: 6.8/10. Published 2021-12-28.
How severe is CVE-2021-35031?: Medium severity. CVSS v3 base score is 6.8 out of 10.