SB2022010307 - Multiple vulnerabilities in Zyxel NBG6604

Security Bulletin ID SB2022010307

Severity

Medium

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Information disclosure

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Insufficient Session Expiration (CVE-ID: CVE-2021-35034)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue in the CGI program. A remote non-authenticated attacker can obtain or guess session token and gain unauthorized access to session that belongs to another user.

2) Cleartext storage of sensitive information (CVE-ID: CVE-2021-35035)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the storage of sensitive information in plain-text within the configuration file. A remote authenticated attacker can retrieve sensitive information stored in cleartext.

Remediation

Install update from vendor's website.

References

https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml