CVE-2018-9129

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://web-in-security.blogspot.com/2018/08/practical-bleichenbacher-attacks-on-ipsec-ike.htmlThird Party Advisory
https://www.zyxel.com/support/bleichenbacher_attack_vulnerability.shtmlPatch, Vendor Advisory
https://web-in-security.blogspot.com/2018/08/practical-bleichenbacher-attacks-on-ipsec-ike.htmlThird Party Advisory
https://www.zyxel.com/support/bleichenbacher_attack_vulnerability.shtmlPatch, Vendor Advisory

Timeline

Published: Aug 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-91306.1IBOS 4.4.3 has XSS via a company full name.CVE-2018-91326.5libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerabil CVE-2018-91336.5ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang CVE-2018-91348.8file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup CVE-2018-91358.8In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.CVE-2018-91365.5windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file, a diffe CVE-2018-91376.8Open-AudIT before 2.2 has CSV Injection.CVE-2018-91385.5An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ de CVE-2018-91399.8On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privileged process via a CVE-2018-91406.1On Samsung mobile devices with M(6.0) software, the Email application allows XSS via an event attribute and arbitrary file loading via a src CVE-2018-91417.8On Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software, Gallery allows remote attackers to execute arbitrary code via a BMP file CVE-2018-91427.0On Samsung mobile devices with N(7.x) software, attackers can install an arbitrary APK in the Secure Folder SD Card area because of faulty v