CVE-2019-15804
Summary
| CVE | CVE-2019-15804 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-11-14 21:15:00 UTC |
| Updated | 2020-08-24 17:37:00 UTC |
| Description | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application (e.g., through CTRL+\ via SSH). The access control check for this menu does work and prohibits accessing the menu, which contains "Password recovery for specific user" options. The menu is believed to be accessible using a serial console. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Zyxel | Gs1900-10hp | - | All | All | All |
| Hardware | Zyxel | Gs1900-10hp | - | All | All | All |
| Operating System | Zyxel | Gs1900-10hp Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-10hp Firmware | All | All | All | All |
| Hardware | Zyxel | Gs1900-16 | - | All | All | All |
| Hardware | Zyxel | Gs1900-16 | - | All | All | All |
| Operating System | Zyxel | Gs1900-16 Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-16 Firmware | All | All | All | All |
| Hardware | Zyxel | Gs1900-24 | - | All | All | All |
| Hardware | Zyxel | Gs1900-24 | - | All | All | All |
| Hardware | Zyxel | Gs1900-24e | - | All | All | All |
| Hardware | Zyxel | Gs1900-24e | - | All | All | All |
| Operating System | Zyxel | Gs1900-24e Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-24e Firmware | All | All | All | All |
| Hardware | Zyxel | Gs1900-24hp | - | All | All | All |
| Hardware | Zyxel | Gs1900-24hp | - | All | All | All |
| Operating System | Zyxel | Gs1900-24hp Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-24hp Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-24 Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-24 Firmware | All | All | All | All |
| Hardware | Zyxel | Gs1900-48 | - | All | All | All |
| Hardware | Zyxel | Gs1900-48 | - | All | All | All |
| Hardware | Zyxel | Gs1900-48hp | - | All | All | All |
| Hardware | Zyxel | Gs1900-48hp | - | All | All | All |
| Operating System | Zyxel | Gs1900-48hp Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-48hp Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-48 Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-48 Firmware | All | All | All | All |
| Hardware | Zyxel | Gs1900-8 | - | All | All | All |
| Hardware | Zyxel | Gs1900-8 | - | All | All | All |
| Hardware | Zyxel | Gs1900-8hp | - | All | All | All |
| Hardware | Zyxel | Gs1900-8hp | - | All | All | All |
| Operating System | Zyxel | Gs1900-8hp Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-8hp Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-8 Firmware | All | All | All | All |
| Operating System | Zyxel | Gs1900-8 Firmware | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Exploring Zyxel GS1900 firmware with Ghidra - [ jasper.la ] | MISC | jasper.la | Exploit, Third Party Advisory |
| Zyxel security advisory for GS1900 switch vulnerabilities | Zyxel | CONFIRM | www.zyxel.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.