Riskcovery

CVE-2021-35033

State
Published
Severity
7.8 High
Published
Nov 23, 2021
Updated
Aug 4, 2024
Reserved
Jun 17, 2021

Read the record on cve.org

Description

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HZyxel

Weaknesses

  • CWE-260 Password in Configuration File

Affected Products

ProductVersions
NBG6818 series firmwareZyxel
  • 1.00(ABSC.0)C0 through 1.00(ABSC.4)C0Affected
NBG7815 series firmwareZyxel
  • 1.00(ABSK.0)C0 through 1.00(ABSK.6)C0Affected
WSQ20 series firmwareZyxel
  • 1.00(ABOF.0)C0 through 1.00(ABOF.10)C0Affected
WSQ50 series firmwareZyxel
  • 1.00(ABKJ.0)C0 through 2.20(ABKJ.6)C0Affected
WSQ60 series firmwareZyxel
  • 1.00(ABND.0)C0 through 2.20(ABND.7)C0Affected
WSR30 series firmwareZyxel
  • 1.00(ABMY.0)C0 through 1.00(ABMY.11)C0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.