What is CVE-2019-15802?

CVE-2019-15802 is a vulnerability found on Zyxel GS1900 devices that allows attackers to decrypt user passwords.

What is the severity of CVE-2019-15802?

The severity of CVE-2019-15802 is medium with a CVSS score of 5.9.

How can attackers exploit CVE-2019-15802?

Attackers can exploit CVE-2019-15802 by decrypting user passwords and gaining unauthorized access to the affected Zyxel GS1900 devices.

How can I fix CVE-2019-15802?

To fix CVE-2019-15802, update your Zyxel GS1900 device firmware to version 2.50(AAHH.0)C0 or later, as provided by Zyxel.

Where can I find more information about CVE-2019-15802?

You can find more information about CVE-2019-15802 in the following references: [link 1](https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html), [link 2](https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml).

Vulnerability/
CVE-2019-15802

medium

5.9

CWE

798

14/11/2019

22/11/2019

CVE-2019-15802

First published: Thu Nov 14 2019(Updated: )

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Zyxel GS1900-8 firmware	<2.50\(aahh.0\)c0
Zyxel GS1900-8
Zyxel Gs1900-8hp Firmware	<2.50\(aahi.0\)c0
Zyxel Gs1900-8hp
Zyxel Gs1900-10hp Firmware	<2.50\(aazi.0\)c0
Zyxel Gs1900-10hp
Zyxel Gs1900-16 Firmware	<2.50\(aahj.0\)c0
Zyxel Gs1900-16
Zyxel Gs1900-24e Firmware	<2.50\(aahk.0\)c0
Zyxel GS1900-24E
Zyxel Gs1900-24 Firmware	<2.50\(aahl.0\)c0
Zyxel GS1900-24
Zyxel Gs1900-24hp Firmware	<2.50\(aahm.0\)c0
Zyxel Gs1900-24hp
Zyxel Gs1900-48 Firmware	<2.50\(aahn.0\)c0
Zyxel Gs1900-48
Zyxel Gs1900-48hp Firmware	<2.50\(aaho.0\)c0
Zyxel Gs1900-48hp

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2019-15802?
CVE-2019-15802 is a vulnerability found on Zyxel GS1900 devices that allows attackers to decrypt user passwords.
What is the severity of CVE-2019-15802?
The severity of CVE-2019-15802 is medium with a CVSS score of 5.9.
How can attackers exploit CVE-2019-15802?
Attackers can exploit CVE-2019-15802 by decrypting user passwords and gaining unauthorized access to the affected Zyxel GS1900 devices.
How can I fix CVE-2019-15802?
To fix CVE-2019-15802, update your Zyxel GS1900 device firmware to version 2.50(AAHH.0)C0 or later, as provided by Zyxel.
Where can I find more information about CVE-2019-15802?
You can find more information about CVE-2019-15802 in the following references: [link 1](https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html), [link 2](https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml).