CVSS 3.0
5.9 mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2018-9129
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zyxel:usg_1100_firmware
- zyxel:usg_110_firmware
- zyxel:usg_1900_firmware
- zyxel:usg_20w-vpn_firmware
- zyxel:usg_20w_firmware
- zyxel:usg_2200-vpn_firmware
- zyxel:usg_310_firmware
- zyxel:usg_40_firmware
- zyxel:usg_40w_firmware
- zyxel:usg_60_firmware
- zyxel:usg_60w_firmware
- zyxel:zywall_1100_firmware
- zyxel:zywall_110_firmware
- zyxel:zywall_310_firmware
- zyxel:zywall_vpn_100_firmware
- zyxel:zywall_vpn_300_firmware
- zyxel:zywall_vpn_50_firmware
References
- ftp://ftp.zyxel.com/USG110/firmware/USG110_4.32%28AAPH.0%29C0_2.pdf
- https://web-in-security.blogspot.com/2018/08/practical-bleichenbacher-attacks-on-ipsec-ike.html
- https://www.zyxel.com/support/bleichenbacher_attack_vulnerability.shtml
- ftp://ftp.zyxel.com/USG110/firmware/USG110_4.32%28AAPH.0%29C0_2.pdf
- https://web-in-security.blogspot.com/2018/08/practical-bleichenbacher-attacks-on-ipsec-ike.html