VAR-201512-0085
Vulnerability from variot - Updated: 2023-12-18 12:20The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. In addition, National Vulnerability Database (NVD) Then CWE-330 , JVNVU#97093739 Then CWE-613 It is published as CWE-330: Use of Insufficiently Random Values http://cwe.mitre.org/data/definitions/330.html CWE-613: Insufficient Session Expiration http://cwe.mitre.org/data/definitions/613.htmlAccess restrictions may be avoided by using an unattended workstation by a third party. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security vulnerability exists in the ZyXEL PMG5318-B20A with firmware version V100AANC0b5. A remote attacker can use the vulnerability information to gain access to the device. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0085",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 1.6,
"vendor": "zyxel",
"version": "v100aanc0b5"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00aanc0b5"
},
{
"model": "pmg5318-b20a",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a v100aanc0b5",
"scope": null,
"trust": 0.3,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 3.40",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "v2"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "pmg5318-b20a 1.00 c0",
"scope": "ne",
"trust": 0.3,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:zyxel:pmg5318-b20a_firmware:v100aanc0b5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Land and Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "77077"
}
],
"trust": 0.3
},
"cve": "CVE-2015-6019",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2015-6019",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2015-06874",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-83980",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.1,
"impactScore": 4.7,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-6019",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2015-6019",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2015-06874",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-346",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-83980",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. In addition, National Vulnerability Database (NVD) Then CWE-330 , JVNVU#97093739 Then CWE-613 It is published as CWE-330: Use of Insufficiently Random Values http://cwe.mitre.org/data/definitions/330.html CWE-613: Insufficient Session Expiration http://cwe.mitre.org/data/definitions/613.htmlAccess restrictions may be avoided by using an unattended workstation by a third party. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security vulnerability exists in the ZyXEL PMG5318-B20A with firmware version V100AANC0b5. A remote attacker can use the vulnerability information to gain access to the device. Multiple ZyXEL Routers are prone to following security vulnerabilities:\n1. An insecure default-password vulnerability\n2. Multiple cross-site scripting vulnerabilities\n3. A command-execution vulnerability\n4. A security-bypass vulnerability\n5. An authorization-bypass\nSuccessful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "VULHUB",
"id": "VHN-83980"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-6019",
"trust": 3.4
},
{
"db": "SECTRACK",
"id": "1034553",
"trust": 1.1
},
{
"db": "JVN",
"id": "JVNVU97093739",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-06874",
"trust": 0.6
},
{
"db": "BID",
"id": "77077",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-83980",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
]
},
"id": "VAR-201512-0085",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
}
],
"trust": 1.2930356
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06874"
}
]
},
"last_update_date": "2023-12-18T12:20:44.580000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "PMG5318-B20A",
"trust": 0.8,
"url": "http://www.zyxel.com/support/supportlandingsr.shtml?c=gb\u0026l=en\u0026kbid=m-01700\u0026md=pmg5318-b20a"
},
{
"title": "ZyXEL Support Center - Latest Release",
"trust": 0.8,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"title": "ZyXEL PMG5318-B20A Session Expiration Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/65623"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://www.kb.cert.org/vuls/id/870744"
},
{
"trust": 1.9,
"url": "https://www.kb.cert.org/vuls/id/bluu-9zqu2r"
},
{
"trust": 1.5,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034553"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6019"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97093739/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6019"
},
{
"trust": 0.3,
"url": "http://www.zyxel.com/th/th/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-13T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-83980"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"date": "2015-12-31T05:59:17.727000",
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"date": "2015-10-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-29T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-83980"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"date": "2016-12-07T18:17:42.343000",
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"date": "2016-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 routers contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…