CVE-2021-3297

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://codeberg.org/nieldk/vulnerabilities/src/branch/main/zyxel%20nbg2105/Admin%20bypass
https://github.com/nieldk/vulnerabilities/blob/main/zyxel%20nbg2105/Admin%20bypassExploit, Third Party Advisory
https://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01490&md=NBG2105Product, Vendor Advisory
https://www.zyxel.com/us/en/support/security_advisories.shtmlVendor Advisory
https://github.com/nieldk/vulnerabilities/blob/main/zyxel%20nbg2105/Admin%20bypassExploit, Third Party Advisory
https://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01490&md=NBG2105Product, Vendor Advisory
https://www.zyxel.com/us/en/support/security_advisories.shtmlVendor Advisory

Timeline

Published: Jan 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-329707.5Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which ma CVE-2021-329717.5Null pointer dereference in SuiteLink server while processing command 0x07 CVE-2021-329725.5Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser CVE-2021-329749.8Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote at CVE-2021-329757.8Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-CVE-2021-329769.8Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attack CVE-2021-329777.2AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.CVE-2021-329787.5The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered passwo CVE-2021-329797.5Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a CVE-2021-32985.4Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manage CVE-2021-329809.8Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming co CVE-2021-329817.2AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or d