Details of VAR-201512-0084

ID

VAR-201512-0084

CVE

CVE-2015-6018

TITLE

ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 routers contain multiple vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#870744

DESCRIPTION

The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security hole exists in the 'PingIPAddr' parameter in the diagnostic ping function of the ZyXEL PMG5318-B20A using V100AANC0b5 firmware. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions

Trust: 3.33

sources: NVD: CVE-2015-6018 // CERT/CC: VU#870744 // JVNDB: JVNDB-2015-006595 // CNVD: CNVD-2015-06884 // BID: 77077 // VULHUB: VHN-83979 // VULMON: CVE-2015-6018

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2015-06884

AFFECTED PRODUCTS

vendor:	zyxel	model:	pmg5318-b20a	scope:	lte	version:	v100aanc0b5	Trust: 1.0
vendor:	zyxel	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	pmg5318-b20a	scope:	lt	version:	1.00(aanc.2)c0	Trust: 0.8
vendor:	zyxel	model:	pmg5318-b20a	scope:	-	version:	-	Trust: 0.6
vendor:	zyxel	model:	pmg5318-b20a	scope:	eq	version:	v100aanc0b5	Trust: 0.6
vendor:	zyxel	model:	pmg5318-b20a v100aanc0b5	scope:	-	version:	-	Trust: 0.3
vendor:	zyxel	model:	p-660hw-t1 3.40	scope:	eq	version:	v2	Trust: 0.3
vendor:	zyxel	model:	nbg-418n	scope:	eq	version:	0	Trust: 0.3
vendor:	zyxel	model:	pmg5318-b20a 1.00 c0	scope:	ne	version:	-	Trust: 0.3

sources: CERT/CC: VU#870744 // CNVD: CNVD-2015-06884 // BID: 77077 // JVNDB: JVNDB-2015-006595 // CNNVD: CNNVD-201510-347 // NVD: CVE-2015-6018

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-6018
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2015-6018
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2015-06884
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201510-347
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-83979
value:	HIGH
Trust: 0.1
VULMON:	CVE-2015-6018
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-6018
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2015-06884
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-83979
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-6018
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2015-06884 // VULHUB: VHN-83979 // VULMON: CVE-2015-6018 // JVNDB: JVNDB-2015-006595 // CNNVD: CNNVD-201510-347 // NVD: CVE-2015-6018

PROBLEMTYPE DATA

problemtype:	CWE-264	Trust: 1.9
problemtype:	CWE-20	Trust: 0.8

sources: VULHUB: VHN-83979 // JVNDB: JVNDB-2015-006595 // NVD: CVE-2015-6018

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201510-347

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201510-347

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-006595

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-83979 // VULMON: CVE-2015-6018

PATCH

title:	PMG5318-B20A	url:	http://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01700&md=PMG5318-B20A	Trust: 0.8
title:	ZyXEL Support Center - Latest Release	url:	http://www.zyxel.com/support/support_landing.shtml	Trust: 0.8
title:	ZyXEL PMG5318-B20A diagnostic ping function input verification vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/65622	Trust: 0.6
title:	ZyXEL PMG5318-B20A diagnostic ping Fixes for feature permission permissions and access control vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58195	Trust: 0.6

sources: CNVD: CNVD-2015-06884 // JVNDB: JVNDB-2015-006595 // CNNVD: CNNVD-201510-347

EXTERNAL IDS

db:	CERT/CC	id:	VU#870744	Trust: 4.3
db:	NVD	id:	CVE-2015-6018	Trust: 3.5
db:	SECTRACK	id:	1034553	Trust: 1.2
db:	EXPLOIT-DB	id:	38455	Trust: 1.2
db:	JVN	id:	JVNVU97093739	Trust: 0.8
db:	JVNDB	id:	JVNDB-2015-006595	Trust: 0.8
db:	CNNVD	id:	CNNVD-201510-347	Trust: 0.7
db:	CNVD	id:	CNVD-2015-06884	Trust: 0.6
db:	BID	id:	77077	Trust: 0.3
db:	PACKETSTORM	id:	133960	Trust: 0.1
db:	VULHUB	id:	VHN-83979	Trust: 0.1
db:	VULMON	id:	CVE-2015-6018	Trust: 0.1

sources: CERT/CC: VU#870744 // CNVD: CNVD-2015-06884 // VULHUB: VHN-83979 // VULMON: CVE-2015-6018 // BID: 77077 // JVNDB: JVNDB-2015-006595 // CNNVD: CNNVD-201510-347 // NVD: CVE-2015-6018

REFERENCES

url:	https://www.kb.cert.org/vuls/id/870744	Trust: 3.6
url:	https://www.kb.cert.org/vuls/id/bluu-9zqu2r	Trust: 2.0
url:	http://www.zyxel.com/support/support_landing.shtml	Trust: 1.5
url:	https://www.exploit-db.com/exploits/38455/	Trust: 1.3
url:	http://www.securitytracker.com/id/1034553	Trust: 1.2
url:	about vulnerability notes	Trust: 0.8
url:	contact us about this vulnerability	Trust: 0.8
url:	provide a vendor statement	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6018	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu97093739/	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6018	Trust: 0.8
url:	http://www.zyxel.com/th/th/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/264.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

CREDITS

Joel Land and Karn Ganeshen

Trust: 0.3

sources: BID: 77077

SOURCES

db:	CERT/CC	id:	VU#870744
db:	CNVD	id:	CNVD-2015-06884
db:	VULHUB	id:	VHN-83979
db:	VULMON	id:	CVE-2015-6018
db:	BID	id:	77077
db:	JVNDB	id:	JVNDB-2015-006595
db:	CNNVD	id:	CNNVD-201510-347
db:	NVD	id:	CVE-2015-6018

LAST UPDATE DATE

2024-11-23T22:31:02.251000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#870744	date:	2015-10-29T00:00:00
db:	CNVD	id:	CNVD-2015-06884	date:	2015-10-28T00:00:00
db:	VULHUB	id:	VHN-83979	date:	2017-09-15T00:00:00
db:	VULMON	id:	CVE-2015-6018	date:	2017-09-15T00:00:00
db:	BID	id:	77077	date:	2015-10-13T00:00:00
db:	JVNDB	id:	JVNDB-2015-006595	date:	2016-01-05T00:00:00
db:	CNNVD	id:	CNNVD-201510-347	date:	2016-01-04T00:00:00
db:	NVD	id:	CVE-2015-6018	date:	2024-11-21T02:34:18.420

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#870744	date:	2015-10-13T00:00:00
db:	CNVD	id:	CNVD-2015-06884	date:	2015-10-27T00:00:00
db:	VULHUB	id:	VHN-83979	date:	2015-12-31T00:00:00
db:	VULMON	id:	CVE-2015-6018	date:	2015-12-31T00:00:00
db:	BID	id:	77077	date:	2015-10-13T00:00:00
db:	JVNDB	id:	JVNDB-2015-006595	date:	2016-01-05T00:00:00
db:	CNNVD	id:	CNNVD-201510-347	date:	2015-10-21T00:00:00
db:	NVD	id:	CVE-2015-6018	date:	2015-12-31T05:59:16.770