ZyXEL ZyWALL Quagga And Zebra Processes Default Account Password Vulnerability
BID:28184
Info
ZyXEL ZyWALL Quagga And Zebra Processes Default Account Password Vulnerability
| Bugtraq ID: | 28184 |
| Class: | Design Error |
| CVE: |
CVE-2008-1160 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 10 2008 12:00AM |
| Updated: | Mar 12 2008 05:41PM |
| Credit: | Pranav Joshi <[email protected]> discovered this issue. |
| Vulnerable: |
ZyXEL ZyWALL 1050 0 |
| Not Vulnerable: | |
Discussion
ZyXEL ZyWALL Quagga And Zebra Processes Default Account Password Vulnerability
ZyXEL ZyWALL 1050 devices contain a default password for their Quagga and Zebra daemon processes. The device fails to change the default password when a legitimate user sets a new password.
Attackers can use this default password to gain unauthorized access to the device. By gaining administrative access to Quagga or Zebra, an attacker can modify network routes on the device, possibly redirecting traffic or denying network service to legitimate users. The attacker may also be able to exploit latent vulnerabilities in the daemon itself.
ZyWALL 1050 is vulnerable; other devices may also be affected.
ZyXEL ZyWALL 1050 devices contain a default password for their Quagga and Zebra daemon processes. The device fails to change the default password when a legitimate user sets a new password.
Attackers can use this default password to gain unauthorized access to the device. By gaining administrative access to Quagga or Zebra, an attacker can modify network routes on the device, possibly redirecting traffic or denying network service to legitimate users. The attacker may also be able to exploit latent vulnerabilities in the daemon itself.
ZyWALL 1050 is vulnerable; other devices may also be affected.
Exploit / POC
ZyXEL ZyWALL Quagga And Zebra Processes Default Account Password Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
ZyXEL ZyWALL Quagga And Zebra Processes Default Account Password Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
ZyXEL ZyWALL Quagga And Zebra Processes Default Account Password Vulnerability
References:
References:
- Vendor Homepage (ZyXEL)