What is CVE-2019-15801?

CVE-2019-15801 is a vulnerability found on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0.

What is the severity of CVE-2019-15801?

The severity of CVE-2019-15801 is high, with a severity value of 7.5.

How does CVE-2019-15801 affect Zyxel GS1900 devices?

CVE-2019-15801 allows attackers to access a diagnostics or password-recovery menu on Zyxel GS1900 devices.

How can I fix CVE-2019-15801?

To fix CVE-2019-15801, update the firmware of Zyxel GS1900 devices to version 2.50(AAHH.0)C0 or later.

Where can I find more information about CVE-2019-15801?

You can find more information about CVE-2019-15801 at the following links: [link1](https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html), [link2](https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml).

Vulnerability/
CVE-2019-15801

high

7.5

CWE

798

14/11/2019

5/8/2024

CVE-2019-15801

First published: Thu Nov 14 2019(Updated: )

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Zyxel GS1900-8 firmware	<2.50\(aahh.0\)c0
Zyxel GS1900-8
Zyxel Gs1900-8hp Firmware	<2.50\(aahi.0\)c0
Zyxel Gs1900-8hp
Zyxel GS1900-10HP firmware	<2.50\(aazi.0\)c0
Zyxel GS1900-10HP
Zyxel Gs1900-16 Firmware	<2.50\(aahj.0\)c0
Zyxel Gs1900-16
Zyxel Gs1900-24e Firmware	<2.50\(aahk.0\)c0
Zyxel GS1900-24E
Zyxel Gs1900-24 Firmware	<2.50\(aahl.0\)c0
Zyxel GS1900-24
Zyxel Gs1900-24hp Firmware	<2.50\(aahm.0\)c0
Zyxel Gs1900-24hp
Zyxel Gs1900-48 Firmware	<2.50\(aahn.0\)c0
Zyxel GS1900-48
Zyxel Gs1900-48hp Firmware	<2.50\(aaho.0\)c0
Zyxel Gs1900-48hp

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2019-15801?
CVE-2019-15801 is a vulnerability found on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0.
What is the severity of CVE-2019-15801?
The severity of CVE-2019-15801 is high, with a severity value of 7.5.
How does CVE-2019-15801 affect Zyxel GS1900 devices?
CVE-2019-15801 allows attackers to access a diagnostics or password-recovery menu on Zyxel GS1900 devices.
How can I fix CVE-2019-15801?
To fix CVE-2019-15801, update the firmware of Zyxel GS1900 devices to version 2.50(AAHH.0)C0 or later.
Where can I find more information about CVE-2019-15801?
You can find more information about CVE-2019-15801 at the following links: [link1](https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html), [link2](https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml).