CVE-2019-6725

The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the interface of the modem can be accessed as admin.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://seclists.org/bugtraq/2019/May/78	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:zyxel:p-660hn-t1_firmware:2.00\(aakk.3\):*:*:*:*:*:*:*

cpe:2.3:h:zyxel:p-660hn-t1:2:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-05-31 22:29

Updated : 2023-12-10 12:59

NVD link : CVE-2019-6725

Mitre link : CVE-2019-6725

CVE.ORG link : CVE-2019-6725

JSON object : View

Products Affected

zyxel

p-660hn-t1_firmware
p-660hn-t1

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2019-6725", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-05-31T22:29:01.300", "references": [{"url": "https://seclists.org/bugtraq/2019/May/78", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the interface of the modem can be accessed as admin."}, {"lang": "es", "value": "La p\u00e1gina ASP rpWLANRedirect.asp es accesible sin identificaci\u00f3n en dispositivos ZyXEL P-660HN-T1 V2 (2.00 (AAKK.3)). Despu\u00e9s de acceder a la p\u00e1gina, la contrase\u00f1a del usuario administrador se puede conseguir al ver el c\u00f3digo fuente HTML y la interfaz del m\u00f3dem puede ser accededida como administrador."}], "lastModified": "2019-06-03T14:43:31.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:p-660hn-t1_firmware:2.00\\(aakk.3\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "915B05E5-A410-4CD3-AE39-2FFC5D31EF59"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:p-660hn-t1:2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CEB9F232-6FE5-4166-B838-B895A4E02D9C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}