CVE-2019-15801 - CVE House
Back to Database
Status published High CVE-2019-15801

An issue was discovered on Zyxel GS1900 devices with firmware...

Vulnerability Description

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-15801

Credits & Attribution

No credits recorded in the NVD database.

References

More from zyxel

View All →
CVE-2021-46387
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by...
Medium 6.1
CVE-2021-3297
On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to...
High 7.8
CVE-2020-29583
Firmware version 4.60 of Zyxel USG devices contains an undocumented...
Unknown 0
CVE-2020-29299
Certain Zyxel products allow command injection by an admin via...
High 7.2
CVE-2020-28899
The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does...
Critical 9.1

Affected Vendor

Affected Software

gs1900-8 firmware, gs1900-8hp firmware, gs1900-10hp firmware, gs1900-16 firmware, gs1900-24e firmware, gs1900-24 firmware, gs1900-24hp firmware, gs1900-48 firmware, gs1900-48hp firmware
Vulnerable Versions:
0

Timeline

Official Publish: November 14th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.