CVE-2022-34746

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-331

Affected software

No affected versions have been published.

Timeline

Published
Sep 20, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-347479.8A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized reCVE-2022-347487.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write paCVE-2022-347497.5In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtrackinCVE-2022-347507.5An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. UnfCVE-2022-347538.8A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rCVE-2022-347546.8A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected PrCVE-2022-347556.7A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a spCVE-2022-347569.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs CVE-2022-347575.3A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connectionCVE-2022-347584.9A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had acCVE-2022-347597.5A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTTCVE-2022-347607.5A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver
CVE-2022-34746: Medium severity, CVSS 5.9 | Vulnix