First published: Wed Mar 26 2008(Updated: )
ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Zyxel Zynos | =3.40-ahq.0 | |
Zyxel Zynos | =3.40-agl.3 | |
Zyxel Zynos | =3.40-ahq.3 | |
Zyxel Zynos | =3.40-ahz.0 | |
Zyxel Prestige 661 | =hw-d1 | |
Zyxel Prestige 660 | =h-d3 | |
Zyxel Zynos | =3.40-atm.0 | |
Zyxel Prestige 660 | =h-d1 | |
Zyxel Zynos | =3.40-agd.2 | |
All of | ||
Any of | ||
ZyXEL P-663HN-51 firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
ZyXEL P-663HN-51 firmware | =3.40\(pe9\) | |
ZyXEL P-663HN-51 firmware | ||
All of | ||
Any of | ||
Zyxel P-660h-61 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660h-61 Firmware | =3.40\(pe9\) | |
Zyxel P-660h-61 | ||
All of | ||
Any of | ||
Zyxel P-660h-63 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660h-63 Firmware | =3.40\(pe9\) | |
Zyxel P-660h-63 | ||
All of | ||
Any of | ||
Zyxel P-660h-67 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660h-67 Firmware | =3.40\(pe9\) | |
Zyxel P-660h-67 | ||
All of | ||
Any of | ||
Zyxel P-660h-d1 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660h-d1 Firmware | =3.40\(pe9\) | |
Zyxel P-660h-d1 | ||
All of | ||
Any of | ||
Zyxel P-660h-d3 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660h-d3 Firmware | =3.40\(pe9\) | |
Zyxel P-660h-d3 | ||
All of | ||
Any of | ||
ZyXEL P-663HN-51 firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
ZyXEL P-663HN-51 firmware | =3.40\(pe9\) | |
ZyXEL P-660HN-51 firmware | ||
All of | ||
Any of | ||
Zyxel P-660h-t1 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660h-t1 Firmware | =3.40\(pe9\) | |
Zyxel P-660h-t1 | ||
All of | ||
Any of | ||
Zyxel P-660hw D1 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660hw D1 Firmware | =3.40\(pe9\) | |
Zyxel P-660hw D1 | ||
All of | ||
Any of | ||
Zyxel P-660hw D3 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660hw D3 Firmware | =3.40\(pe9\) | |
Zyxel P-660hw D3 | ||
All of | ||
Any of | ||
Zyxel P-660hw T3 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-660hw T3 Firmware | =3.40\(pe9\) | |
Zyxel P-660hw T3 | ||
All of | ||
Any of | ||
Zyxel P-661hnu-f1 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-661hnu-f1 Firmware | =3.40\(pe9\) | |
Zyxel P-661hnu-f1 | ||
All of | ||
Any of | ||
Zyxel P-661h Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-661h Firmware | =3.40\(pe9\) | |
Zyxel P-661h | ||
All of | ||
Any of | ||
Zyxel P-661hw-d1 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-661hw-d1 Firmware | =3.40\(pe9\) | |
Zyxel P-661hw-d1 | ||
All of | ||
Any of | ||
Zyxel P-661hnu-f3 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-661hnu-f3 Firmware | =3.40\(pe9\) | |
Zyxel P-661hnu-f3 | ||
All of | ||
Any of | ||
Zyxel P-662hw-d3 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-662hw-d3 Firmware | =3.40\(pe9\) | |
Zyxel P-662hw-d3 | ||
All of | ||
Any of | ||
Zyxel P-662hw-d Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-662hw-d Firmware | =3.40\(pe9\) | |
Zyxel P-662hw-d | ||
All of | ||
Any of | ||
Zyxel P-662hw-d1 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-662hw-d1 Firmware | =3.40\(pe9\) | |
Zyxel P-662hw-d1 | ||
All of | ||
Any of | ||
Zyxel P-662h-61 Firmware | >=3.40\(agd.2\)<=3.40\(ahq.3\) | |
Zyxel P-662h-61 Firmware | =3.40\(pe9\) | |
Zyxel P-662h-61 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2008-1526 is considered a high-severity vulnerability due to the lack of a salt in MD5 password hashing, making it easier to crack passwords.
To fix CVE-2008-1526, upgrade your ZyXEL Prestige router firmware to a version that implements secure password hashing.
CVE-2008-1526 affects several ZyXEL Prestige models, specifically the P-660, P-661, and P-662 with specific firmware versions.
CVE-2008-1526 can lead to unauthorized access to the network if attackers successfully crack weak passwords.
If updating firmware is not possible, it is recommended to change passwords to complex, unique options to mitigate the risk associated with CVE-2008-1526.