Insufficient Entropy Vulnerability in Zyxel GS1900 Series Switches

CVE-2022-34746

Summary

An insufficient entropy vulnerability has been identified in the firmware of Zyxel GS1900 series switches, where the improper use of randomness sources for RSA key pair generation can lead to security risks. An unauthenticated attacker could exploit this weakness to retrieve private keys by factoring the RSA modulus found in the certificates of the web administration interface, posing significant risks to network security. Users are advised to update to firmware version V2.70 or later to mitigate this issue.

References