CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2019-15801
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-798
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zyxel:gs1900-10hp_firmware
- zyxel:gs1900-16_firmware
- zyxel:gs1900-24_firmware
- zyxel:gs1900-24e_firmware
- zyxel:gs1900-24hp_firmware
- zyxel:gs1900-48_firmware
- zyxel:gs1900-48hp_firmware
- zyxel:gs1900-8_firmware
- zyxel:gs1900-8hp_firmware