|
ZyXEL Prestige Routers Unprotected Reset Functionality
|
|
Secunia Advisory:
|
SA13278
|
|
|
Release Date:
|
2004-11-24
|
|
Last Update:
|
2005-02-21
|
|
Popularity:
|
10,020 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
DoS
|
|
Where:
|
From local network
|
|
Solution Status:
|
Unpatched
|
|
| OS: | ZyXEL ZyNOS 3.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2004-1540
|
|
Description:
Francisco "José" Canela has reported a vulnerability in ZyXEL Prestige 650HW, which can be exploited by malicious people to reset the configuration of a vulnerable device.
The problem is that "/rpFWUpload.html" used for uploading firmware and resetting the configuration isn't protected. This can be exploited to reset the configuration and potentially hi-jack the device.
This has been reported to affect ZyXEL Prestige 650HW, Prestige 623, Prestige 645-A1 series, and Prestige 652 series. Other devices running ZyNOS may also be affected.
Solution:
Filter access to affected devices.
Provided and/or discovered by:
Francisco "José" Canela
Changelog:
2004-11-25: Added other Prestige routers as being affected.
2004-11-26: Added Prestige 645-A1 series as affected.
2005-02-21: Added CVE reference.
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
