CVE-2017-7964: Critical severity Zyxel Wre6505 Firmware vulnerability
Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacking attacks by reconfiguring the built-in dnshijacker process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict TELNET access to trusted sources only (e.g., block TELNET at the network perimeter/firewall or allow-list management IPs) to prevent remote attackers from reconfiguring the built-in dnshijacker process.
- Operational
Change the default TELNET password (initially 1234) for the root and admin accounts on Zyxel WRE6505 devices to unique strong credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7964?
CVE-2017-7964 is classified as a high severity vulnerability due to the default TELNET password exposure.
How do I fix CVE-2017-7964?
To fix CVE-2017-7964, change the default TELNET password from '1234' to a strong, unique password.
What devices are affected by CVE-2017-7964?
CVE-2017-7964 affects Zyxel WRE6505 devices running firmware versions up to v1.00(aaqb.3)c0.
What type of attacks can exploit CVE-2017-7964?
CVE-2017-7964 can be exploited for DNS hijacking attacks by reconfiguring the device's dnshijacker process.
How can I determine if my Zyxel device is vulnerable to CVE-2017-7964?
You can determine if your Zyxel device is vulnerable to CVE-2017-7964 by checking if it uses the default TELNET password and runs the affected firmware version.