CVE-2021-35033 (GCVE-0-2021-35033)
Vulnerability from cvelistv5 – Published: 2021-11-23 21:20 – Updated: 2024-08-04 00:33
VLAI
EPSS
VEX
Summary
A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.
Severity
7.8 (High)
CWE
- CWE-260 - Password in Configuration File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.zyxel.com/support/Zyxel_security_advi… | x_refsource_CONFIRM |
| https://www.tenable.com/security/research/tra-2022-06 | x_refsource_MISC |
Impacted products
6 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Zyxel | NBG6818 series firmware |
Affected:
1.00(ABSC.0)C0 through 1.00(ABSC.4)C0
|
guessed | |
| Zyxel | NBG7815 series firmware |
Affected:
1.00(ABSK.0)C0 through 1.00(ABSK.6)C0
|
guessed | |
| Zyxel | WSQ20 series firmware |
Affected:
1.00(ABOF.0)C0 through 1.00(ABOF.10)C0
|
guessed | |
| Zyxel | WSQ50 series firmware |
Affected:
1.00(ABKJ.0)C0 through 2.20(ABKJ.6)C0
|
guessed | |
| Zyxel | WSQ60 series firmware |
Affected:
1.00(ABND.0)C0 through 2.20(ABND.7)C0
|
guessed | |
| Zyxel | WSR30 series firmware |
Affected:
1.00(ABMY.0)C0 through 1.00(ABMY.11)C0
|
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:33:49.871Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2022-06"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "NBG6818 series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "1.00(ABSC.0)C0 through 1.00(ABSC.4)C0"
}
]
},
{
"product": "NBG7815 series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "1.00(ABSK.0)C0 through 1.00(ABSK.6)C0"
}
]
},
{
"product": "WSQ20 series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "1.00(ABOF.0)C0 through 1.00(ABOF.10)C0"
}
]
},
{
"product": "WSQ50 series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "1.00(ABKJ.0)C0 through 2.20(ABKJ.6)C0"
}
]
},
{
"product": "WSQ60 series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "1.00(ABND.0)C0 through 2.20(ABND.7)C0"
}
]
},
{
"product": "WSR30 series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "1.00(ABMY.0)C0 through 1.00(ABMY.11)C0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-260",
"description": "CWE-260: Password in Configuration File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-28T19:06:14.000Z",
"orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"shortName": "Zyxel"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2022-06"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@zyxel.com.tw",
"ID": "CVE-2021-35033",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NBG6818 series firmware",
"version": {
"version_data": [
{
"version_value": "1.00(ABSC.0)C0 through 1.00(ABSC.4)C0"
}
]
}
},
{
"product_name": "NBG7815 series firmware",
"version": {
"version_data": [
{
"version_value": "1.00(ABSK.0)C0 through 1.00(ABSK.6)C0"
}
]
}
},
{
"product_name": "WSQ20 series firmware",
"version": {
"version_data": [
{
"version_value": "1.00(ABOF.0)C0 through 1.00(ABOF.10)C0"
}
]
}
},
{
"product_name": "WSQ50 series firmware",
"version": {
"version_data": [
{
"version_value": "1.00(ABKJ.0)C0 through 2.20(ABKJ.6)C0"
}
]
}
},
{
"product_name": "WSQ60 series firmware",
"version": {
"version_data": [
{
"version_value": "1.00(ABND.0)C0 through 2.20(ABND.7)C0"
}
]
}
},
{
"product_name": "WSR30 series firmware",
"version": {
"version_data": [
{
"version_value": "1.00(ABMY.0)C0 through 1.00(ABMY.11)C0"
}
]
}
}
]
},
"vendor_name": "Zyxel"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user."
}
]
},
"impact": {
"cvss": {
"baseScore": "7.8",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-260: Password in Configuration File"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml",
"refsource": "CONFIRM",
"url": "https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml"
},
{
"name": "https://www.tenable.com/security/research/tra-2022-06",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2022-06"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"assignerShortName": "Zyxel",
"cveId": "CVE-2021-35033",
"datePublished": "2021-11-23T21:20:38.000Z",
"dateReserved": "2021-06-17T00:00:00.000Z",
"dateUpdated": "2024-08-04T00:33:49.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-35033",
"date": "2026-09-17",
"epss": "0.00409",
"percentile": "0.34749"
},
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:zyxel:nbg6818_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.00\\\\(absc.5\\\\)c0\", \"matchCriteriaId\": \"1A2D09B3-6B56-483A-AB24-808930548DA4\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:zyxel:nbg6818:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"48E677C4-EE44-49C4-8CD5-CABE12F00097\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:zyxel:nbg7815_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.00\\\\(absk.7\\\\)c0\", \"matchCriteriaId\": \"E77E348E-B055-4D4F-A7E2-3209504DF004\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:zyxel:nbg7815:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D2E6D3DD-B789-4984-BE39-717071EC5B4E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:zyxel:wsq20_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.00\\\\(abof.11\\\\)c0\", \"matchCriteriaId\": \"7FC79265-D940-4D82-A220-A28D435DDEF1\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:zyxel:wsq20:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"49AD416D-70DC-49E9-AEBB-3DB68E1E42D7\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:zyxel:wsq50_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.20\\\\(abkj.7\\\\)c0\", \"matchCriteriaId\": \"FB22F798-9303-45FB-AD7D-10062177D564\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:zyxel:wsq50:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B604D99D-276D-48B3-A696-18A496F3DCFF\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:zyxel:wsq60_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.20\\\\(abnd.8\\\\)c0\", \"matchCriteriaId\": \"E67B738F-87A9-461C-93E1-45A600B73F62\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:zyxel:wsq60:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36E6D0E9-9BA8-42C4-9D6D-6DED3CA3BFEB\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:zyxel:wsr30_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.00\\\\(abmy.12\\\\)c0\", \"matchCriteriaId\": \"41B324F6-3588-468E-A63B-F621ABEDA92B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:zyxel:wsr30:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2F062047-27C3-4FCE-A1BB-A3ED6E3BDA05\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en versiones espec\\u00edficas del firmware de Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60 y WSR30 con administaci\\u00f3n de contrase\\u00f1as preconfigurada podr\\u00eda permitir a un atacante obtener acceso root del dispositivo, si el atacante local desmonta el dispositivo y usa un cable USB a UART para conectarlo, o si la funcionalidad remote assistance ha sido habilitada por un usuario autenticado\"}]",
"id": "CVE-2021-35033",
"lastModified": "2024-11-21T06:11:42.923",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security@zyxel.com.tw\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 6.9, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.4, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2021-11-23T22:15:07.623",
"references": "[{\"url\": \"https://www.tenable.com/security/research/tra-2022-06\", \"source\": \"security@zyxel.com.tw\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml\", \"source\": \"security@zyxel.com.tw\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.tenable.com/security/research/tra-2022-06\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "security@zyxel.com.tw",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security@zyxel.com.tw\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-260\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-35033\",\"sourceIdentifier\":\"security@zyxel.com.tw\",\"published\":\"2021-11-23T22:15:07.623\",\"lastModified\":\"2024-11-21T06:11:42.923\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en versiones espec\u00edficas del firmware de Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60 y WSR30 con administaci\u00f3n de contrase\u00f1as preconfigurada podr\u00eda permitir a un atacante obtener acceso root del dispositivo, si el atacante local desmonta el dispositivo y usa un cable USB a UART para conectarlo, o si la funcionalidad remote assistance ha sido habilitada por un usuario autenticado\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@zyxel.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":6.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.4,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security@zyxel.com.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-260\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:zyxel:nbg6818_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.00\\\\(absc.5\\\\)c0\",\"matchCriteriaId\":\"1A2D09B3-6B56-483A-AB24-808930548DA4\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:zyxel:nbg6818:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48E677C4-EE44-49C4-8CD5-CABE12F00097\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:zyxel:nbg7815_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.00\\\\(absk.7\\\\)c0\",\"matchCriteriaId\":\"E77E348E-B055-4D4F-A7E2-3209504DF004\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:zyxel:nbg7815:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2E6D3DD-B789-4984-BE39-717071EC5B4E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:zyxel:wsq20_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.00\\\\(abof.11\\\\)c0\",\"matchCriteriaId\":\"7FC79265-D940-4D82-A220-A28D435DDEF1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:zyxel:wsq20:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49AD416D-70DC-49E9-AEBB-3DB68E1E42D7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:zyxel:wsq50_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.20\\\\(abkj.7\\\\)c0\",\"matchCriteriaId\":\"FB22F798-9303-45FB-AD7D-10062177D564\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:zyxel:wsq50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B604D99D-276D-48B3-A696-18A496F3DCFF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:zyxel:wsq60_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.20\\\\(abnd.8\\\\)c0\",\"matchCriteriaId\":\"E67B738F-87A9-461C-93E1-45A600B73F62\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:zyxel:wsq60:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36E6D0E9-9BA8-42C4-9D6D-6DED3CA3BFEB\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:zyxel:wsr30_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.00\\\\(abmy.12\\\\)c0\",\"matchCriteriaId\":\"41B324F6-3588-468E-A63B-F621ABEDA92B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:zyxel:wsr30:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F062047-27C3-4FCE-A1BB-A3ED6E3BDA05\"}]}]}],\"references\":[{\"url\":\"https://www.tenable.com/security/research/tra-2022-06\",\"source\":\"security@zyxel.com.tw\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml\",\"source\":\"security@zyxel.com.tw\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.tenable.com/security/research/tra-2022-06\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"redhat_vex": {
"current_release_date": "2026-03-27T13:52:46+00:00",
"cve": "CVE-2021-35033",
"id": "CVE-2021-35033",
"initial_release_date": "2021-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "CVE-2021-35033",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-35033.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…