Zyxel Zynos vulnerabilities

15 CVEs affecting Zyxel Zynos, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2008-1529, published 2008-03-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2004-1540, published 2004-12-31. Medium severity, CVSS 5.0. EPSS: 6.6% chance of exploitation in the next 30 days. ZyXEL Prestige 623, 650, and 652 HW Routers, and possibly other versions, with HTTP Remote Administration enabled, does not require a password to access rpFWUpload.html, which allows remote attackers…
CVE-2007-1586, published 2007-03-21. High severity, CVSS 7.8. EPSS: 3.2% chance of exploitation in the next 30 days. ZynOS 3.40 allows remote attackers to cause a denial of service (link restart) by sending a request for the name \M via the SMB Mail Slot Protocol.
CVE-2007-4318, published 2007-08-13. Medium severity, CVSS 4.3. EPSS: 2.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Forms/General_1 in the management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allows remote authenticated administrators to inject…
CVE-2008-1527, published 2008-03-26. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), support authentication over HTTP via a hash string in the hiddenPassword…
CVE-2004-1684, published 2004-09-13. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2007-4319, published 2007-08-13. Medium severity, CVSS 4.0. EPSS: 1.4% chance of exploitation in the next 30 days. The management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allows remote authenticated administrators to cause a denial of service (infinite reboot loop) via invalid…
CVE-2008-1522, published 2008-03-26. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), have (1) "user" as their default password for the "user" account and (2) "1234" as their…
CVE-2007-4317, published 2007-08-13. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allow remote attackers to perform certain actions as…
CVE-2008-1524, published 2008-03-26. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has "public" as its default community for both (1) read and (2) write…
CVE-2008-1529, published 2008-03-26. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. ZyXEL Prestige routers have a minimum password length for the admin account that is too small, which makes it easier for remote attackers to guess passwords via brute force methods.

Latest

CVE-2008-1528, published 2008-03-26. Medium severity, CVSS 4.0. EPSS: 1.1% chance of exploitation in the next 30 days. ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain authentication data by making direct HTTP…
CVE-2008-1525, published 2008-03-26. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. The default SNMP configuration on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has a Trusted Host value of 0.0.0.0, which allows remote…
CVE-2008-1523, published 2008-03-26. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain ISP and Dynamic DNS credentials by sending a…
CVE-2008-1521, published 2008-03-26. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to gain privileges by accessing administrative URIs, as…