CVE-2018-9149

The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor.

CVSS v3 6.8 MEDIUM
CVSS v2.0 7.2 HIGH

6.8^/10

CVSS v3 : MEDIUM

Vector : AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.slideshare.net/secret/qrHwDOJ71eLg7f	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:zyxel:ac3000_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ac3000:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-04-01 18:29

Updated : 2024-02-04 19:46

NVD link : CVE-2018-9149

Mitre link : CVE-2018-9149

CVE.ORG link : CVE-2018-9149

JSON object : View

Products Affected

zyxel

ac3000
ac3000_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2018-9149", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2018-04-01T18:29:00.287", "references": [{"url": "https://www.slideshare.net/secret/qrHwDOJ71eLg7f", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor."}, {"lang": "es", "value": "El dispositivo Zyxel Multy X (AC3000 Tri-Band WiFi System) no utiliza un mecanismo adecuado para proteger el UART. Despu\u00e9s de que un atacante inutilice el dispositivo y emplee un cable USB-UART para conectarse al dispositivo, puede utilizar la contrase\u00f1a 1234 para iniciar sesi\u00f3n en el sistema con la cuenta root. Adem\u00e1s, un atacante puede iniciar el servicio TELNET del dispositivo como una puerta trasera."}], "lastModified": "2019-03-14T14:01:26.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:ac3000_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD60F05E-3F39-48F8-8DD4-3EEE351AF4AE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:ac3000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "09CD4481-EA99-4565-8F60-96E79ADECA36"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}