ZyXEL GS1900 prior 2.50(AAHH.0)C0 libfds.so fds_sys_passDebugPasswd_ret Parameter input validation

Summaryinfo

A vulnerability has been found in ZyXEL GS1900 and classified as critical. This affects the function fds_sys_passDebugPasswd_ret of the file libfds.so. Performing a manipulation as part of Parameter results in input validation. This vulnerability is known as CVE-2019-15803. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in ZyXEL GS1900. This affects the function fds_sys_passDebugPasswd_ret of the file libfds.so. The manipulation as part of a Parameter leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fds_sys_passDebugPasswd_ret(). The firmware contains access control checks that determine if remote users are allowed to access this functionality. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return TRUE with no actual checks performed. The diagnostics menu allows for reading/writing arbitrary registers and various other configuration parameters which are believed to be related to the network interface chips.

The weakness was published 11/14/2019 (Website). The advisory is shared at zyxel.com. This vulnerability is uniquely identified as CVE-2019-15803 since 08/29/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2.50(AAHH.0)C0 eliminates this vulnerability.

Similar entries are available at VDB-145781, VDB-145782, VDB-145783 and VDB-145784. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• ZyXEL

Name

• GS1900

License

• commercial

Website

• Vendor: https://www.zyxel.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion