CVE-2019-17354

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify data fields of the page.

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-173559.8In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available t CVE-2019-173566.5The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrate CVE-2019-173576.5Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when CVE-2019-173588.1Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays CVE-2019-173597.5The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError CVE-2019-17366.6A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Ext CVE-2019-173607.5A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service (D CVE-2019-173619.8In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unau CVE-2019-173629.1In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UT CVE-2019-173649.8The processCommandUploadLog() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers t CVE-2019-173657.8Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directorie CVE-2019-173668.8Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control.