CVE-2019-15801

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.htmlExploit, Third Party Advisory
https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtmlVendor Advisory
https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.htmlExploit, Third Party Advisory
https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtmlVendor Advisory

Timeline

Published: Nov 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-158025.9An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hard CVE-2019-158039.1An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocum CVE-2019-158047.5An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented fu CVE-2019-158059.8CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative inter CVE-2019-158069.8CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative inter CVE-2019-158074.7In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will CVE-2019-158094.7Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in E CVE-2019-15819.8A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with netwo CVE-2019-158106.1Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.CVE-2019-158116.1In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.CVE-2019-158138.8Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a we CVE-2019-158145.4Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.