Summaryinfo

A vulnerability classified as critical has been found in ZyXEL GS1510-16. This issue affects some unknown processing of the file webctrl.cgi of the component Authentication Handler. Performing a manipulation results in information disclosure. Moreover, an exploit is present. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability classified as very critical has been found in ZyXEL GS1510-16 (version now known). This affects some unknown processing of the file webctrl.cgi of the component Authentication Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was disclosed 11/29/2013 by Daniel Manser and Sven Vetsch as added ZyXEL GS1510-16 Password Extractor as confirmed git commit (GIT Repository). It is possible to read the advisory at github.com. The vendor was not involved in the public release. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/23/2019). The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

A public exploit has been developed by Tod Beardsley (todb-r7) in Ruby and been published immediately after the advisory. The exploit is shared for download at github.com. It is declared as highly functional.

It is possible to mitigate the weakness by firewalling . The git commit contains the following remark:

The vulnerable device has reached end of life for support from the manufacturer, so it is unlikely this problem will be addressed.

The vulnerability is also documented in the vulnerability database at OSVDB (100510†). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• ZyXEL

Name

• GS1510-16

License

• commercial

Website

• Vendor: https://www.zyxel.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion