#VU20343 Insufficiently protected credentials in Zebra Hardware solutions


Published: 2019-08-21 | Updated: 2019-08-21

Vulnerability identifier: #VU20343

Vulnerability risk: Low

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2019-10960

CWE-ID: CWE-522

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
220Xi4
Hardware solutions / Office equipment, IP-phones, print servers
ZT200
Hardware solutions / Office equipment, IP-phones, print servers
ZT400
Hardware solutions / Office equipment, IP-phones, print servers
ZT510
Hardware solutions / Office equipment, IP-phones, print servers
ZT600
Hardware solutions / Office equipment, IP-phones, print servers

Vendor: Zebra

Description

The vulnerability allows a remote attacker to access the front control panel passcode of the affected device.

The vulnerability exists due to insufficiently protected credentials in the affected device. A remote attacker can send a specially crafted packets to a port on the printer and retrieve a front control panel passcode.

Note: Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

220Xi4: All versions

ZT200: All versions

ZT400: All versions

ZT510: All versions

ZT600: All versions

External links
http://www.us-cert.gov/ics/advisories/icsa-19-232-01
http://www.zebra.com/gb/en/products/software/barcode-printers/link-os.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Information disclosure in Zebra Industrial Printers