Weak Password Encryption in Zyxel GS1900 Devices

CVE-2019-15802

What is CVE-2019-15802?

A vulnerability exists in Zyxel GS1900 devices where the firmware uses a hardcoded cryptographic key for password hashing and encryption. This flaw affects the sal_util_str_encrypt() function in libsal.so.0.0, as the device employs AES256 encryption in CBC mode with known parameters including the salt, IV, and key data. Consequently, all encrypted passwords, including those embedded in configuration backups, can be decrypted, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References