Search
Find a vulnerability
Search criteria
13 vulnerabilities found for nbg-418n by zyxel
VAR-201512-0085
Vulnerability from variot - Updated: 2025-04-13 23:14The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. In addition, National Vulnerability Database (NVD) Then CWE-330 , JVNVU#97093739 Then CWE-613 It is published as CWE-330: Use of Insufficiently Random Values http://cwe.mitre.org/data/definitions/330.html CWE-613: Insufficient Session Expiration http://cwe.mitre.org/data/definitions/613.htmlAccess restrictions may be avoided by using an unattended workstation by a third party. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security vulnerability exists in the ZyXEL PMG5318-B20A with firmware version V100AANC0b5. A remote attacker can use the vulnerability information to gain access to the device. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0085",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 1.6,
"vendor": "zyxel",
"version": "v100aanc0b5"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00aanc0b5"
},
{
"model": "pmg5318-b20a",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a v100aanc0b5",
"scope": null,
"trust": 0.3,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 3.40",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "v2"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "pmg5318-b20a 1.00 c0",
"scope": "ne",
"trust": 0.3,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zyxel:pmg5318-b20a_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Land and Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "77077"
}
],
"trust": 0.3
},
"cve": "CVE-2015-6019",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2015-6019",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2015-06874",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-83980",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.1,
"id": "CVE-2015-6019",
"impactScore": 4.7,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-6019",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2015-6019",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2015-06874",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-346",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-83980",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. In addition, National Vulnerability Database (NVD) Then CWE-330 , JVNVU#97093739 Then CWE-613 It is published as CWE-330: Use of Insufficiently Random Values http://cwe.mitre.org/data/definitions/330.html CWE-613: Insufficient Session Expiration http://cwe.mitre.org/data/definitions/613.htmlAccess restrictions may be avoided by using an unattended workstation by a third party. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security vulnerability exists in the ZyXEL PMG5318-B20A with firmware version V100AANC0b5. A remote attacker can use the vulnerability information to gain access to the device. Multiple ZyXEL Routers are prone to following security vulnerabilities:\n1. An insecure default-password vulnerability\n2. Multiple cross-site scripting vulnerabilities\n3. A command-execution vulnerability\n4. A security-bypass vulnerability\n5. An authorization-bypass\nSuccessful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6019"
},
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "VULHUB",
"id": "VHN-83980"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-6019",
"trust": 3.4
},
{
"db": "SECTRACK",
"id": "1034553",
"trust": 1.1
},
{
"db": "JVN",
"id": "JVNVU97093739",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-06874",
"trust": 0.6
},
{
"db": "BID",
"id": "77077",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-83980",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"id": "VAR-201512-0085",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
}
],
"trust": 1.2930356
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06874"
}
]
},
"last_update_date": "2025-04-13T23:14:23.838000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "PMG5318-B20A",
"trust": 0.8,
"url": "http://www.zyxel.com/support/SupportLandingSR.shtml?c=gb\u0026l=en\u0026kbid=M-01700\u0026md=PMG5318-B20A"
},
{
"title": "ZyXEL Support Center - Latest Release",
"trust": 0.8,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"title": "ZyXEL PMG5318-B20A Session Expiration Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/65623"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://www.kb.cert.org/vuls/id/870744"
},
{
"trust": 1.9,
"url": "https://www.kb.cert.org/vuls/id/bluu-9zqu2r"
},
{
"trust": 1.5,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034553"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6019"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97093739/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6019"
},
{
"trust": 0.3,
"url": "http://www.zyxel.com/th/th/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"db": "VULHUB",
"id": "VHN-83980"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
},
{
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-13T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-83980"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"date": "2015-10-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-346"
},
{
"date": "2015-12-31T05:59:17.727000",
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-29T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06874"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-83980"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006596"
},
{
"date": "2016-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-346"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-6019"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 routers contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-346"
}
],
"trust": 0.6
}
}
VAR-201512-0093
Vulnerability from variot - Updated: 2025-04-13 23:14The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session. ZyXEL NBG-418N router, firmware version 1.00(AADZ.3)C0, uses default credentials and is vulnerable to cross-site request forgery. ZyXELNBG-418N is a wireless broadband router from ZyXEL Technology. ZyXELNBG-418Ndeviceswithfirmware1.00(AADZ.3)C0 has a credential management vulnerability. An attacker can exploit these issues to gain unauthorized access, allowing attackers to perform certain unauthorized actions or by tricking a victim into following a specially crafted HTTP request designed to perform some action on the attacker's behalf using a victim's currently active session. The vulnerability is caused by using '1234' as the password for the admin account
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0093",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nbg-418n",
"scope": "eq",
"trust": 1.6,
"vendor": "zyxel",
"version": "1.00\\(aadz.3\\)c0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "nbg-418n",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00(aadz.3)c0"
},
{
"model": "nbg-418n devices with 1.00 c0",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-314"
},
{
"db": "NVD",
"id": "CVE-2015-7283"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:zyxel:nbg-418n",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:nbg-418n_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Land of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "78819"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-314"
}
],
"trust": 0.9
},
"cve": "CVE-2015-7283",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2015-7283",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2016-00152",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-85244",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"id": "CVE-2015-7283",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-7283",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2015-7283",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2016-00152",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201512-314",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-85244",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"db": "VULHUB",
"id": "VHN-85244"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-314"
},
{
"db": "NVD",
"id": "CVE-2015-7283"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session. ZyXEL NBG-418N router, firmware version 1.00(AADZ.3)C0, uses default credentials and is vulnerable to cross-site request forgery. ZyXELNBG-418N is a wireless broadband router from ZyXEL Technology. ZyXELNBG-418Ndeviceswithfirmware1.00(AADZ.3)C0 has a credential management vulnerability. \nAn attacker can exploit these issues to gain unauthorized access, allowing attackers to perform certain unauthorized actions or by tricking a victim into following a specially crafted HTTP request designed to perform some action on the attacker\u0027s behalf using a victim\u0027s currently active session. The vulnerability is caused by using \u00271234\u0027 as the password for the admin account",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-7283"
},
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"db": "BID",
"id": "78819"
},
{
"db": "VULHUB",
"id": "VHN-85244"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#330000",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-7283",
"trust": 3.4
},
{
"db": "BID",
"id": "78819",
"trust": 2.0
},
{
"db": "SECTRACK",
"id": "1034554",
"trust": 1.1
},
{
"db": "JVN",
"id": "JVNVU90501820",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006554",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201512-314",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-00152",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-85244",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"db": "VULHUB",
"id": "VHN-85244"
},
{
"db": "BID",
"id": "78819"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-314"
},
{
"db": "NVD",
"id": "CVE-2015-7283"
}
]
},
"id": "VAR-201512-0093",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"db": "VULHUB",
"id": "VHN-85244"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00152"
}
]
},
"last_update_date": "2025-04-13T23:14:23.799000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Download Library",
"trust": 0.8,
"url": "http://www.zyxel.com/us/en/support/download_library/product/nbg_418n_7.shtml?c=us\u0026l=en\u0026pid=20120320173444\u0026tab=Firmware"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-85244"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"db": "NVD",
"id": "CVE-2015-7283"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://www.kb.cert.org/vuls/id/330000"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/78819"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034554"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7283"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu90501820/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7283"
},
{
"trust": 0.3,
"url": "http://www.zyxel.com/th/th/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"db": "VULHUB",
"id": "VHN-85244"
},
{
"db": "BID",
"id": "78819"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-314"
},
{
"db": "NVD",
"id": "CVE-2015-7283"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"db": "VULHUB",
"id": "VHN-85244"
},
{
"db": "BID",
"id": "78819"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-314"
},
{
"db": "NVD",
"id": "CVE-2015-7283"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-12-10T00:00:00",
"db": "CERT/CC",
"id": "VU#330000"
},
{
"date": "2016-01-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-85244"
},
{
"date": "2015-12-10T00:00:00",
"db": "BID",
"id": "78819"
},
{
"date": "2016-01-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"date": "2015-12-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201512-314"
},
{
"date": "2015-12-31T05:59:25.260000",
"db": "NVD",
"id": "CVE-2015-7283"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-12-10T00:00:00",
"db": "CERT/CC",
"id": "VU#330000"
},
{
"date": "2016-01-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00152"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-85244"
},
{
"date": "2015-12-10T00:00:00",
"db": "BID",
"id": "78819"
},
{
"date": "2016-01-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006554"
},
{
"date": "2016-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201512-314"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-7283"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201512-314"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL NBG-418N router uses default credentials and is vulnerable to cross-site request forgery",
"sources": [
{
"db": "CERT/CC",
"id": "VU#330000"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201512-314"
}
],
"trust": 0.6
}
}
VAR-201512-0086
Vulnerability from variot - Updated: 2025-04-13 23:14ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL PMG5318-B20A There is a vulnerability in the device firmware that can gain administrator privileges. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A remote attacker could exploit this vulnerability to modify the system configuration. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0086",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 1.6,
"vendor": "zyxel",
"version": "v100aanc0b5"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00aanc0b5"
},
{
"model": "pmg5318-b20a",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a v100aanc0b5",
"scope": null,
"trust": 0.3,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 3.40",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "v2"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "pmg5318-b20a 1.00 c0",
"scope": "ne",
"trust": 0.3,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-345"
},
{
"db": "NVD",
"id": "CVE-2015-6020"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zyxel:pmg5318-b20a_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Land and Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "77077"
}
],
"trust": 0.3
},
"cve": "CVE-2015-6020",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CVE-2015-6020",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2015-06873",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "VHN-83981",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.1,
"id": "CVE-2015-6020",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-6020",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2015-6020",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2015-06873",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-345",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-83981",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"db": "VULHUB",
"id": "VHN-83981"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-345"
},
{
"db": "NVD",
"id": "CVE-2015-6020"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL PMG5318-B20A There is a vulnerability in the device firmware that can gain administrator privileges. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A remote attacker could exploit this vulnerability to modify the system configuration. Multiple ZyXEL Routers are prone to following security vulnerabilities:\n1. An insecure default-password vulnerability\n2. Multiple cross-site scripting vulnerabilities\n3. A command-execution vulnerability\n4. A security-bypass vulnerability\n5. An authorization-bypass\nSuccessful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6020"
},
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "VULHUB",
"id": "VHN-83981"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-6020",
"trust": 3.4
},
{
"db": "SECTRACK",
"id": "1034553",
"trust": 1.1
},
{
"db": "JVN",
"id": "JVNVU97093739",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-345",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-06873",
"trust": 0.6
},
{
"db": "BID",
"id": "77077",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-83981",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"db": "VULHUB",
"id": "VHN-83981"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-345"
},
{
"db": "NVD",
"id": "CVE-2015-6020"
}
]
},
"id": "VAR-201512-0086",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"db": "VULHUB",
"id": "VHN-83981"
}
],
"trust": 1.2930356
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06873"
}
]
},
"last_update_date": "2025-04-13T23:14:23.759000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "PMG5318-B20A",
"trust": 0.8,
"url": "http://www.zyxel.com/support/SupportLandingSR.shtml?c=gb\u0026l=en\u0026kbid=M-01700\u0026md=PMG5318-B20A"
},
{
"title": "ZyXEL Support Center - Latest Release",
"trust": 0.8,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"title": "ZyXEL PMG5318-B20A patch for incorrect authorization vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/65624"
},
{
"title": "ZyXEL PMG5318-B20A Fixes for permission permissions and access control vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58193"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-345"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-83981"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"db": "NVD",
"id": "CVE-2015-6020"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://www.kb.cert.org/vuls/id/870744"
},
{
"trust": 1.9,
"url": "https://www.kb.cert.org/vuls/id/bluu-9zqu2r"
},
{
"trust": 1.5,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034553"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6020"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97093739/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6020"
},
{
"trust": 0.3,
"url": "http://www.zyxel.com/th/th/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"db": "VULHUB",
"id": "VHN-83981"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-345"
},
{
"db": "NVD",
"id": "CVE-2015-6020"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"db": "VULHUB",
"id": "VHN-83981"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-345"
},
{
"db": "NVD",
"id": "CVE-2015-6020"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-13T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-83981"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"date": "2015-10-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-345"
},
{
"date": "2015-12-31T05:59:18.617000",
"db": "NVD",
"id": "CVE-2015-6020"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-29T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06873"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-83981"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006597"
},
{
"date": "2016-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-345"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-6020"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-345"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 routers contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-345"
}
],
"trust": 0.6
}
}
VAR-201512-0082
Vulnerability from variot - Updated: 2025-04-13 23:14ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 are products of ZyXEL Technology. Both NBG-418N and P-660HW-T1 are wireless broadband routers; PMG5318-B20A is a wireless switch product. There are security vulnerabilities in several ZyXEL routers. A remote attacker could exploit this vulnerability to modify the system configuration. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions. There is a security vulnerability in ZyXEL P-660HW-T1 2 devices using ZyNOS 3.40(AXH.0) firmware, PMG5318-B20A devices and NBG-418N devices using 1.00AANC0b5 firmware. The vulnerability is caused by using '1234' as admin account password
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0082",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 1.6,
"vendor": "zyxel",
"version": "v100aanc0b5"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 1.6,
"vendor": "zyxel",
"version": null
},
{
"model": "nbg-418n",
"scope": null,
"trust": 1.4,
"vendor": "zyxel",
"version": null
},
{
"model": "zynos",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "3.40\\(axh.0\\)"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 v2",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00aanc0b5"
},
{
"model": "zynos",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "3.40(axh.0) (2007 year 3 moon 30 day ) (p660hw-t1 v2)"
},
{
"model": "p-660hw-t1",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 2",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a v100aanc0b5",
"scope": null,
"trust": 0.3,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 3.40",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "v2"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "pmg5318-b20a 1.00 c0",
"scope": "ne",
"trust": 0.3,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-349"
},
{
"db": "NVD",
"id": "CVE-2015-6016"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:zyxel:nbg-418n",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:zyxel:p-660hw-t1_v2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:pmg5318-b20a_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:zynos_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Land and Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "77077"
}
],
"trust": 0.3
},
"cve": "CVE-2015-6016",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2015-6016",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2015-06900",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-83977",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2015-6016",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-6016",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2015-6016",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2015-06900",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-349",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-83977",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"db": "VULHUB",
"id": "VHN-83977"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-349"
},
{
"db": "NVD",
"id": "CVE-2015-6016"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 are products of ZyXEL Technology. Both NBG-418N and P-660HW-T1 are wireless broadband routers; PMG5318-B20A is a wireless switch product. There are security vulnerabilities in several ZyXEL routers. A remote attacker could exploit this vulnerability to modify the system configuration. An insecure default-password vulnerability\n2. Multiple cross-site scripting vulnerabilities\n3. A command-execution vulnerability\n4. A security-bypass vulnerability\n5. An authorization-bypass\nSuccessful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions. There is a security vulnerability in ZyXEL P-660HW-T1 2 devices using ZyNOS 3.40(AXH.0) firmware, PMG5318-B20A devices and NBG-418N devices using 1.00AANC0b5 firmware. The vulnerability is caused by using \u00271234\u0027 as admin account password",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6016"
},
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "VULHUB",
"id": "VHN-83977"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-6016",
"trust": 3.4
},
{
"db": "SECTRACK",
"id": "1034553",
"trust": 1.1
},
{
"db": "SECTRACK",
"id": "1034552",
"trust": 1.1
},
{
"db": "SECTRACK",
"id": "1034554",
"trust": 1.1
},
{
"db": "JVN",
"id": "JVNVU97093739",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-349",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-06900",
"trust": 0.6
},
{
"db": "BID",
"id": "77077",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-83977",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"db": "VULHUB",
"id": "VHN-83977"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-349"
},
{
"db": "NVD",
"id": "CVE-2015-6016"
}
]
},
"id": "VAR-201512-0082",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"db": "VULHUB",
"id": "VHN-83977"
}
],
"trust": 1.2930356
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06900"
}
]
},
"last_update_date": "2025-04-13T23:14:23.720000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NBG-418N",
"trust": 0.8,
"url": "http://www.zyxel.com/support/SupportLandingSR.shtml?c=gb\u0026l=en\u0026kbid=M-01393\u0026md=NBG-418N"
},
{
"title": "PMG5318-B20A",
"trust": 0.8,
"url": "http://www.zyxel.com/support/SupportLandingSR.shtml?c=gb\u0026l=en\u0026kbid=M-01700\u0026md=PMG5318-B20A"
},
{
"title": "P-660HW-T1 v2",
"trust": 0.8,
"url": "http://www.zyxel.com/support/SupportLandingSR.shtml?c=gb\u0026l=en\u0026kbid=MD06084\u0026md=P-660HW-T1%20v2"
},
{
"title": "ZyXEL Support Center - Latest Release",
"trust": 0.8,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"title": "DefaultPassword",
"trust": 0.8,
"url": "https://default-password.info/zyxel/"
},
{
"title": "Patches for multiple ZyXEL router credential management vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/65620"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-83977"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"db": "NVD",
"id": "CVE-2015-6016"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://www.kb.cert.org/vuls/id/870744"
},
{
"trust": 1.9,
"url": "https://www.kb.cert.org/vuls/id/bluu-9zqu2r"
},
{
"trust": 1.5,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034552"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034553"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034554"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6016"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97093739/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6016"
},
{
"trust": 0.3,
"url": "http://www.zyxel.com/th/th/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"db": "VULHUB",
"id": "VHN-83977"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-349"
},
{
"db": "NVD",
"id": "CVE-2015-6016"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"db": "VULHUB",
"id": "VHN-83977"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-349"
},
{
"db": "NVD",
"id": "CVE-2015-6016"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-13T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-83977"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"date": "2015-10-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-349"
},
{
"date": "2015-12-31T05:59:14.833000",
"db": "NVD",
"id": "CVE-2015-6016"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-29T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06900"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-83977"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006593"
},
{
"date": "2016-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-349"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-6016"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-349"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 routers contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-349"
}
],
"trust": 0.6
}
}
VAR-201512-0083
Vulnerability from variot - Updated: 2025-04-13 23:14Multiple cross-site scripting (XSS) vulnerabilities in Forms/rpAuth_1 on ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0) allow remote attackers to inject arbitrary web script or HTML via the (1) LoginPassword or (2) hiddenPassword parameter. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL P-660HW-T1 v2 Device firmware ZyNOS of Forms/rpAuth_1 Contains a cross-site scripting vulnerability. In addition, JVNVU#97093739 Then CWE-80 It is published as CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) http://cwe.mitre.org/data/definitions/80.htmlBy a third party (1) LoginPassword Or (2) hiddenPassword Any via parameter Web Script or HTML May be inserted. The Zyxel P-660HW-T1 is a wireless router product from ZyXEL Technology. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0083",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "p-660hw-t1 v2",
"scope": "eq",
"trust": 1.6,
"vendor": "zyxel",
"version": "3.40\\(axh.0\\)"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 v2",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "zynos",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "3.40 (axh.0) (2007 year 3 moon 30 day )"
},
{
"model": "p-660hw-t1",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a v100aanc0b5",
"scope": null,
"trust": 0.3,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 3.40",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "v2"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "pmg5318-b20a 1.00 c0",
"scope": "ne",
"trust": 0.3,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-348"
},
{
"db": "NVD",
"id": "CVE-2015-6017"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:zyxel:p-660hw-t1_v2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:zynos_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Land and Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "77077"
}
],
"trust": 0.3
},
"cve": "CVE-2015-6017",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2015-6017",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2015-06885",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-83978",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2015-6017",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-6017",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2015-6017",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2015-06885",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-348",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-83978",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "VULHUB",
"id": "VHN-83978"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-348"
},
{
"db": "NVD",
"id": "CVE-2015-6017"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site scripting (XSS) vulnerabilities in Forms/rpAuth_1 on ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0) allow remote attackers to inject arbitrary web script or HTML via the (1) LoginPassword or (2) hiddenPassword parameter. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL P-660HW-T1 v2 Device firmware ZyNOS of Forms/rpAuth_1 Contains a cross-site scripting vulnerability. In addition, JVNVU#97093739 Then CWE-80 It is published as CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) http://cwe.mitre.org/data/definitions/80.htmlBy a third party (1) LoginPassword Or (2) hiddenPassword Any via parameter Web Script or HTML May be inserted. The Zyxel P-660HW-T1 is a wireless router product from ZyXEL Technology. Multiple ZyXEL Routers are prone to following security vulnerabilities:\n1. An insecure default-password vulnerability\n2. A command-execution vulnerability\n4. A security-bypass vulnerability\n5. An authorization-bypass\nSuccessful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6017"
},
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "VULHUB",
"id": "VHN-83978"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-6017",
"trust": 3.4
},
{
"db": "SECTRACK",
"id": "1034552",
"trust": 1.1
},
{
"db": "JVN",
"id": "JVNVU97093739",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-348",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-06885",
"trust": 0.6
},
{
"db": "BID",
"id": "77077",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-83978",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "VULHUB",
"id": "VHN-83978"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-348"
},
{
"db": "NVD",
"id": "CVE-2015-6017"
}
]
},
"id": "VAR-201512-0083",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "VULHUB",
"id": "VHN-83978"
}
],
"trust": 1.3363635999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06885"
}
]
},
"last_update_date": "2025-04-13T23:14:23.680000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "P-660HW-T1 v2",
"trust": 0.8,
"url": "http://www.zyxel.com/support/SupportLandingSR.shtml?c=gb\u0026l=en\u0026kbid=MD06084\u0026md=P-660HW-T1%20v2"
},
{
"title": "ZyXEL Support Center - Latest Release",
"trust": 0.8,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"title": "Patch for ZyXEL P-660HW-T1 Cross-Site Scripting Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/65621"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-83978"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"db": "NVD",
"id": "CVE-2015-6017"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://www.kb.cert.org/vuls/id/870744"
},
{
"trust": 1.9,
"url": "https://www.kb.cert.org/vuls/id/bluu-9zqu2r"
},
{
"trust": 1.5,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034552"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6017"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97093739/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6017"
},
{
"trust": 0.3,
"url": "http://www.zyxel.com/th/th/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "VULHUB",
"id": "VHN-83978"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-348"
},
{
"db": "NVD",
"id": "CVE-2015-6017"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "VULHUB",
"id": "VHN-83978"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-348"
},
{
"db": "NVD",
"id": "CVE-2015-6017"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-13T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-83978"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"date": "2015-10-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-348"
},
{
"date": "2015-12-31T05:59:15.880000",
"db": "NVD",
"id": "CVE-2015-6017"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-29T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-83978"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006594"
},
{
"date": "2016-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-348"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-6017"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-348"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL P-660HW-T1 Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06885"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-348"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-348"
}
],
"trust": 0.6
}
}
VAR-201512-0084
Vulnerability from variot - Updated: 2025-04-13 23:14The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security hole exists in the 'PingIPAddr' parameter in the diagnostic ping function of the ZyXEL PMG5318-B20A using V100AANC0b5 firmware. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0084",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pmg5318-b20a",
"scope": "lte",
"trust": 1.0,
"vendor": "zyxel",
"version": "v100aanc0b5"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a",
"scope": "lt",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00(aanc.2)c0"
},
{
"model": "pmg5318-b20a",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
},
{
"model": "pmg5318-b20a",
"scope": "eq",
"trust": 0.6,
"vendor": "zyxel",
"version": "v100aanc0b5"
},
{
"model": "pmg5318-b20a v100aanc0b5",
"scope": null,
"trust": 0.3,
"vendor": "zyxel",
"version": null
},
{
"model": "p-660hw-t1 3.40",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "v2"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "pmg5318-b20a 1.00 c0",
"scope": "ne",
"trust": 0.3,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-347"
},
{
"db": "NVD",
"id": "CVE-2015-6018"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zyxel:pmg5318-b20a_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Land and Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "77077"
}
],
"trust": 0.3
},
"cve": "CVE-2015-6018",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2015-6018",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-06884",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-83979",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2015-6018",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-6018",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2015-6018",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2015-06884",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-347",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-83979",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2015-6018",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"db": "VULHUB",
"id": "VHN-83979"
},
{
"db": "VULMON",
"id": "CVE-2015-6018"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-347"
},
{
"db": "NVD",
"id": "CVE-2015-6018"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security hole exists in the \u0027PingIPAddr\u0027 parameter in the diagnostic ping function of the ZyXEL PMG5318-B20A using V100AANC0b5 firmware. Multiple ZyXEL Routers are prone to following security vulnerabilities:\n1. An insecure default-password vulnerability\n2. Multiple cross-site scripting vulnerabilities\n3. A command-execution vulnerability\n4. A security-bypass vulnerability\n5. An authorization-bypass\nSuccessful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6018"
},
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "VULHUB",
"id": "VHN-83979"
},
{
"db": "VULMON",
"id": "CVE-2015-6018"
}
],
"trust": 3.33
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-83979",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=38455",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-83979"
},
{
"db": "VULMON",
"id": "CVE-2015-6018"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744",
"trust": 4.3
},
{
"db": "NVD",
"id": "CVE-2015-6018",
"trust": 3.5
},
{
"db": "SECTRACK",
"id": "1034553",
"trust": 1.2
},
{
"db": "EXPLOIT-DB",
"id": "38455",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU97093739",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-347",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-06884",
"trust": 0.6
},
{
"db": "BID",
"id": "77077",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "133960",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-83979",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2015-6018",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"db": "VULHUB",
"id": "VHN-83979"
},
{
"db": "VULMON",
"id": "CVE-2015-6018"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-347"
},
{
"db": "NVD",
"id": "CVE-2015-6018"
}
]
},
"id": "VAR-201512-0084",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"db": "VULHUB",
"id": "VHN-83979"
}
],
"trust": 1.2930356
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06884"
}
]
},
"last_update_date": "2025-04-13T23:14:23.637000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "PMG5318-B20A",
"trust": 0.8,
"url": "http://www.zyxel.com/support/SupportLandingSR.shtml?c=gb\u0026l=en\u0026kbid=M-01700\u0026md=PMG5318-B20A"
},
{
"title": "ZyXEL Support Center - Latest Release",
"trust": 0.8,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"title": "ZyXEL PMG5318-B20A diagnostic ping function input verification vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/65622"
},
{
"title": "ZyXEL PMG5318-B20A diagnostic ping Fixes for feature permission permissions and access control vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58195"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-347"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
},
{
"problemtype": "CWE-20",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-83979"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"db": "NVD",
"id": "CVE-2015-6018"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.6,
"url": "https://www.kb.cert.org/vuls/id/870744"
},
{
"trust": 2.0,
"url": "https://www.kb.cert.org/vuls/id/bluu-9zqu2r"
},
{
"trust": 1.5,
"url": "http://www.zyxel.com/support/support_landing.shtml"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/38455/"
},
{
"trust": 1.2,
"url": "http://www.securitytracker.com/id/1034553"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6018"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97093739/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6018"
},
{
"trust": 0.3,
"url": "http://www.zyxel.com/th/th/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/264.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"db": "VULHUB",
"id": "VHN-83979"
},
{
"db": "VULMON",
"id": "CVE-2015-6018"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-347"
},
{
"db": "NVD",
"id": "CVE-2015-6018"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#870744"
},
{
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"db": "VULHUB",
"id": "VHN-83979"
},
{
"db": "VULMON",
"id": "CVE-2015-6018"
},
{
"db": "BID",
"id": "77077"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-347"
},
{
"db": "NVD",
"id": "CVE-2015-6018"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-13T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-83979"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULMON",
"id": "CVE-2015-6018"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"date": "2015-10-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-347"
},
{
"date": "2015-12-31T05:59:16.770000",
"db": "NVD",
"id": "CVE-2015-6018"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-29T00:00:00",
"db": "CERT/CC",
"id": "VU#870744"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06884"
},
{
"date": "2017-09-15T00:00:00",
"db": "VULHUB",
"id": "VHN-83979"
},
{
"date": "2017-09-15T00:00:00",
"db": "VULMON",
"id": "CVE-2015-6018"
},
{
"date": "2015-10-13T00:00:00",
"db": "BID",
"id": "77077"
},
{
"date": "2016-01-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006595"
},
{
"date": "2016-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-347"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-6018"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-347"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 routers contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#870744"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-347"
}
],
"trust": 0.6
}
}
VAR-201512-0094
Vulnerability from variot - Updated: 2025-04-13 23:14Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users. ZyXELNBG-418N is a wireless broadband router from ZyXEL Technology. An attacker can exploit these issues to gain unauthorized access, allowing attackers to perform certain unauthorized actions or by tricking a victim into following a specially crafted HTTP request designed to perform some action on the attacker's behalf using a victim's currently active session. A remote attacker could exploit this vulnerability to perform unauthorized operations
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0094",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nbg-418n",
"scope": "eq",
"trust": 1.6,
"vendor": "zyxel",
"version": "1.00\\(aadz.3\\)c0"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "*"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "nbg-418n",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00(aadz.3)c0"
},
{
"model": "nbg-418n devices with 1.00 c0",
"scope": null,
"trust": 0.6,
"vendor": "zyxel",
"version": null
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-315"
},
{
"db": "NVD",
"id": "CVE-2015-7284"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:zyxel:nbg-418n",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zyxel:nbg-418n_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Land of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "78819"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-315"
}
],
"trust": 0.9
},
"cve": "CVE-2015-7284",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2015-7284",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2016-00151",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-85245",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.1,
"id": "CVE-2015-7284",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-7284",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2015-7284",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2016-00151",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201512-315",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-85245",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"db": "VULHUB",
"id": "VHN-85245"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-315"
},
{
"db": "NVD",
"id": "CVE-2015-7284"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users. ZyXELNBG-418N is a wireless broadband router from ZyXEL Technology. \nAn attacker can exploit these issues to gain unauthorized access, allowing attackers to perform certain unauthorized actions or by tricking a victim into following a specially crafted HTTP request designed to perform some action on the attacker\u0027s behalf using a victim\u0027s currently active session. A remote attacker could exploit this vulnerability to perform unauthorized operations",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-7284"
},
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"db": "BID",
"id": "78819"
},
{
"db": "VULHUB",
"id": "VHN-85245"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#330000",
"trust": 4.2
},
{
"db": "NVD",
"id": "CVE-2015-7284",
"trust": 3.4
},
{
"db": "BID",
"id": "78819",
"trust": 2.0
},
{
"db": "SECTRACK",
"id": "1034554",
"trust": 1.1
},
{
"db": "JVN",
"id": "JVNVU90501820",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006555",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201512-315",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-00151",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-85245",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"db": "VULHUB",
"id": "VHN-85245"
},
{
"db": "BID",
"id": "78819"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-315"
},
{
"db": "NVD",
"id": "CVE-2015-7284"
}
]
},
"id": "VAR-201512-0094",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"db": "VULHUB",
"id": "VHN-85245"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00151"
}
]
},
"last_update_date": "2025-04-13T23:14:23.599000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Download Library",
"trust": 0.8,
"url": "http://www.zyxel.com/us/en/support/download_library/product/nbg_418n_7.shtml?c=us\u0026l=en\u0026pid=20120320173444\u0026tab=Firmware"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-85245"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"db": "NVD",
"id": "CVE-2015-7284"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://www.kb.cert.org/vuls/id/330000"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/78819"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1034554"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7284"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu90501820/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7284"
},
{
"trust": 0.3,
"url": "http://www.zyxel.com/th/th/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"db": "VULHUB",
"id": "VHN-85245"
},
{
"db": "BID",
"id": "78819"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-315"
},
{
"db": "NVD",
"id": "CVE-2015-7284"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#330000"
},
{
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"db": "VULHUB",
"id": "VHN-85245"
},
{
"db": "BID",
"id": "78819"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-315"
},
{
"db": "NVD",
"id": "CVE-2015-7284"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-12-10T00:00:00",
"db": "CERT/CC",
"id": "VU#330000"
},
{
"date": "2016-01-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"date": "2015-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-85245"
},
{
"date": "2015-12-10T00:00:00",
"db": "BID",
"id": "78819"
},
{
"date": "2016-01-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"date": "2015-12-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201512-315"
},
{
"date": "2015-12-31T05:59:26.217000",
"db": "NVD",
"id": "CVE-2015-7284"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-12-10T00:00:00",
"db": "CERT/CC",
"id": "VU#330000"
},
{
"date": "2016-01-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00151"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-85245"
},
{
"date": "2015-12-10T00:00:00",
"db": "BID",
"id": "78819"
},
{
"date": "2016-01-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006555"
},
{
"date": "2016-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201512-315"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-7284"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201512-315"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZyXEL NBG-418N router uses default credentials and is vulnerable to cross-site request forgery",
"sources": [
{
"db": "CERT/CC",
"id": "VU#330000"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201512-315"
}
],
"trust": 0.6
}
}
VAR-201903-0022
Vulnerability from variot - Updated: 2024-11-23 23:08Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF. Zyxel NBG-418N v2 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ZyxelNBG-418Nv2Modem is a wireless router from ZyXEL Technology. A cross-site request forgery vulnerability exists in the ZyxelNBG-418Nv2Modem1.00 (AAXM.6) C0 release that could be exploited by a remote attacker to perform unauthorized operations
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201903-0022",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nbg-418n",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "1.00\\(aaxm.6\\)c0"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00(aaxm.4)c0"
},
{
"model": "nbg-418n modem 1.00 c0",
"scope": "eq",
"trust": 0.6,
"vendor": "zyxel",
"version": "v2"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03785"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"db": "NVD",
"id": "CVE-2019-6710"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zyxel:nbg-418n_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
}
]
},
"cve": "CVE-2019-6710",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2019-6710",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2019-03785",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2019-6710",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-6710",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2019-6710",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-03785",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201901-896",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03785"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-896"
},
{
"db": "NVD",
"id": "CVE-2019-6710"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF. Zyxel NBG-418N v2 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ZyxelNBG-418Nv2Modem is a wireless router from ZyXEL Technology. A cross-site request forgery vulnerability exists in the ZyxelNBG-418Nv2Modem1.00 (AAXM.6) C0 release that could be exploited by a remote attacker to perform unauthorized operations",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-6710"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"db": "CNVD",
"id": "CNVD-2019-03785"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-6710",
"trust": 3.0
},
{
"db": "EXPLOIT-DB",
"id": "46240",
"trust": 3.0
},
{
"db": "JVNDB",
"id": "JVNDB-2019-002254",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2019-03785",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201901-896",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03785"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-896"
},
{
"db": "NVD",
"id": "CVE-2019-6710"
}
]
},
"id": "VAR-201903-0022",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03785"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03785"
}
]
},
"last_update_date": "2024-11-23T23:08:27.102000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NBG-418N v2",
"trust": 0.8,
"url": "https://www.zyxel.com/us/en/support/DownloadLandingSR.shtml?c=us\u0026l=en\u0026kbid=M-02059\u0026md=NBG-418N%20v2#searchZyxelTab1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"db": "NVD",
"id": "CVE-2019-6710"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://twitter.com/god3err/status/1088067902832631809"
},
{
"trust": 1.6,
"url": "https://alicangonullu.biz/konu/3"
},
{
"trust": 1.6,
"url": "https://www.exploit-db.com/exploits/46240/"
},
{
"trust": 1.4,
"url": "https://www.exploit-db.com/exploits/46240"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6710"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6710"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03785"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-896"
},
{
"db": "NVD",
"id": "CVE-2019-6710"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-03785"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-896"
},
{
"db": "NVD",
"id": "CVE-2019-6710"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-02-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-03785"
},
{
"date": "2019-04-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"date": "2019-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-896"
},
{
"date": "2019-03-07T23:29:01.547000",
"db": "NVD",
"id": "CVE-2019-6710"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-02-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-03785"
},
{
"date": "2019-04-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-002254"
},
{
"date": "2019-04-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201901-896"
},
{
"date": "2024-11-21T04:46:59.573000",
"db": "NVD",
"id": "CVE-2019-6710"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-896"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zyxel NBG-418N v2 Modem Cross-Site Request Forgery Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03785"
},
{
"db": "CNNVD",
"id": "CNNVD-201901-896"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201901-896"
}
],
"trust": 0.6
}
}
VAR-201910-1281
Vulnerability from variot - Updated: 2024-11-23 22:41wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify data fields of the page. Zyxel NBG-418N v2 Authentication firmware contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ZyXEL NBG-418N v2 is a wireless router from China ZyXEL (ZyXEL) company.
The wan.htm page in Zyxel NBG-418N v2 using V1.00 (AARP.9) C0 firmware has an authorization issue vulnerability. The vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products. There is currently no detailed vulnerability details provided
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-1281",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nbg-418n v2",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "1.00\\(aarp.9\\)c0"
},
{
"model": "nbg-418n",
"scope": "eq",
"trust": 0.8,
"vendor": "zyxel",
"version": "1.00(aarp.9)c0"
},
{
"model": "nbg-418n v1.00 c0",
"scope": "eq",
"trust": 0.6,
"vendor": "zyxel",
"version": "v2"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28446"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"db": "NVD",
"id": "CVE-2019-17354"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zyxel:nbg-418n_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
}
]
},
"cve": "CVE-2019-17354",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2019-17354",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2020-28446",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-149592",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2019-17354",
"impactScore": 5.5,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.4,
"baseSeverity": "Critical",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2019-17354",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-17354",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2019-17354",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2020-28446",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201910-506",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-149592",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28446"
},
{
"db": "VULHUB",
"id": "VHN-149592"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-506"
},
{
"db": "NVD",
"id": "CVE-2019-17354"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify data fields of the page. Zyxel NBG-418N v2 Authentication firmware contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ZyXEL NBG-418N v2 is a wireless router from China ZyXEL (ZyXEL) company. \n\r\n\r\nThe wan.htm page in Zyxel NBG-418N v2 using V1.00 (AARP.9) C0 firmware has an authorization issue vulnerability. The vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products. There is currently no detailed vulnerability details provided",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-17354"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"db": "CNVD",
"id": "CNVD-2020-28446"
},
{
"db": "VULHUB",
"id": "VHN-149592"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-17354",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010637",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-28446",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201910-506",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-149592",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28446"
},
{
"db": "VULHUB",
"id": "VHN-149592"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-506"
},
{
"db": "NVD",
"id": "CVE-2019-17354"
}
]
},
"id": "VAR-201910-1281",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28446"
},
{
"db": "VULHUB",
"id": "VHN-149592"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28446"
}
]
},
"last_update_date": "2024-11-23T22:41:18.844000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NBG-418N v2",
"trust": 0.8,
"url": "https://www.zyxel.com/us/en/support/DownloadLandingSR.shtml?c=us\u0026l=en\u0026kbid=M-02059\u0026md=NBG-418N%20v2#searchZyxelTab1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-306",
"trust": 1.1
},
{
"problemtype": "CWE-287",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-149592"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"db": "NVD",
"id": "CVE-2019-17354"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://github.com/d0x0/zyxel-nbg-418n-v2/blob/master/cve-2019-17354"
},
{
"trust": 1.7,
"url": "https://www.zyxel.com/us/en/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-17354"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17354"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-149592"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-506"
},
{
"db": "NVD",
"id": "CVE-2019-17354"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-28446"
},
{
"db": "VULHUB",
"id": "VHN-149592"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-506"
},
{
"db": "NVD",
"id": "CVE-2019-17354"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-05-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-28446"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-149592"
},
{
"date": "2019-10-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"date": "2019-10-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-506"
},
{
"date": "2019-10-09T12:15:10.547000",
"db": "NVD",
"id": "CVE-2019-17354"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-05-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-28446"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-149592"
},
{
"date": "2019-10-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-010637"
},
{
"date": "2020-10-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-506"
},
{
"date": "2024-11-21T04:32:09.397000",
"db": "NVD",
"id": "CVE-2019-17354"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-506"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zyxel NBG-418N v2 Vulnerabilities related to authentication in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-010637"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "access control error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-506"
}
],
"trust": 0.6
}
}
CVE-2015-7284 (GCVE-0-2015-7284)
Vulnerability from nvd – Published: 2015-12-31 02:00 – Updated: 2024-08-06 07:43
VLAI
EPSS
VEX
Summary
Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securitytracker.com/id/1034554 | vdb-entryx_refsource_SECTRACK |
| http://www.securityfocus.com/bid/78819 | vdb-entryx_refsource_BID |
| https://www.kb.cert.org/vuls/id/330000 | third-party-advisoryx_refsource_CERT-VN |
Date Public
2015-12-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T07:43:46.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1034554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "78819",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/78819"
},
{
"name": "VU#330000",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/330000"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T14:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "1034554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "78819",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/78819"
},
{
"name": "VU#330000",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://www.kb.cert.org/vuls/id/330000"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2015-7284",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1034554",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "78819",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/78819"
},
{
"name": "VU#330000",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/330000"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2015-7284",
"datePublished": "2015-12-31T02:00:00.000Z",
"dateReserved": "2015-09-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T07:43:46.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-6016 (GCVE-0-2015-6016)
Vulnerability from nvd – Published: 2015-12-31 02:00 – Updated: 2024-08-06 07:06
VLAI
EPSS
VEX
Summary
ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securitytracker.com/id/1034554 | vdb-entryx_refsource_SECTRACK |
| http://www.securitytracker.com/id/1034553 | vdb-entryx_refsource_SECTRACK |
| http://www.securitytracker.com/id/1034552 | vdb-entryx_refsource_SECTRACK |
| https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R | x_refsource_CONFIRM |
| https://www.kb.cert.org/vuls/id/870744 | third-party-advisoryx_refsource_CERT-VN |
Date Public
2015-10-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T07:06:35.028Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1034554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "1034553",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034553"
},
{
"name": "1034552",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034552"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R"
},
{
"name": "VU#870744",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/870744"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T14:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "1034554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "1034553",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034553"
},
{
"name": "1034552",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034552"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R"
},
{
"name": "VU#870744",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://www.kb.cert.org/vuls/id/870744"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2015-6016",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1034554",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "1034553",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034553"
},
{
"name": "1034552",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034552"
},
{
"name": "https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R",
"refsource": "CONFIRM",
"url": "https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R"
},
{
"name": "VU#870744",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/870744"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2015-6016",
"datePublished": "2015-12-31T02:00:00.000Z",
"dateReserved": "2015-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T07:06:35.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-7284 (GCVE-0-2015-7284)
Vulnerability from cvelistv5 – Published: 2015-12-31 02:00 – Updated: 2024-08-06 07:43
VLAI
EPSS
VEX
Summary
Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securitytracker.com/id/1034554 | vdb-entryx_refsource_SECTRACK |
| http://www.securityfocus.com/bid/78819 | vdb-entryx_refsource_BID |
| https://www.kb.cert.org/vuls/id/330000 | third-party-advisoryx_refsource_CERT-VN |
Date Public
2015-12-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T07:43:46.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1034554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "78819",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/78819"
},
{
"name": "VU#330000",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/330000"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T14:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "1034554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "78819",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/78819"
},
{
"name": "VU#330000",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://www.kb.cert.org/vuls/id/330000"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2015-7284",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1034554",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "78819",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/78819"
},
{
"name": "VU#330000",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/330000"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2015-7284",
"datePublished": "2015-12-31T02:00:00.000Z",
"dateReserved": "2015-09-18T00:00:00.000Z",
"dateUpdated": "2024-08-06T07:43:46.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-6016 (GCVE-0-2015-6016)
Vulnerability from cvelistv5 – Published: 2015-12-31 02:00 – Updated: 2024-08-06 07:06
VLAI
EPSS
VEX
Summary
ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securitytracker.com/id/1034554 | vdb-entryx_refsource_SECTRACK |
| http://www.securitytracker.com/id/1034553 | vdb-entryx_refsource_SECTRACK |
| http://www.securitytracker.com/id/1034552 | vdb-entryx_refsource_SECTRACK |
| https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R | x_refsource_CONFIRM |
| https://www.kb.cert.org/vuls/id/870744 | third-party-advisoryx_refsource_CERT-VN |
Date Public
2015-10-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T07:06:35.028Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1034554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "1034553",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034553"
},
{
"name": "1034552",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034552"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R"
},
{
"name": "VU#870744",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/870744"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T14:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "1034554",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "1034553",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034553"
},
{
"name": "1034552",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034552"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R"
},
{
"name": "VU#870744",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://www.kb.cert.org/vuls/id/870744"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2015-6016",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1034554",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034554"
},
{
"name": "1034553",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034553"
},
{
"name": "1034552",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034552"
},
{
"name": "https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R",
"refsource": "CONFIRM",
"url": "https://www.kb.cert.org/vuls/id/BLUU-9ZQU2R"
},
{
"name": "VU#870744",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/870744"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2015-6016",
"datePublished": "2015-12-31T02:00:00.000Z",
"dateReserved": "2015-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T07:06:35.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}