Lucene search

[email protected]CVE-2018-9129

HistoryAug 15, 2018 - 6:29 p.m.

CVE-2018-9129

2018-08-1518:29:01

[email protected]

web.nvd.nist.gov

cve-2018-9129

zyxel

zywall

usg

ike

bleichenbacher

vulnerability

ipsec

vpn

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.0%

JSON

ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.

Affected configurations

NVD

Node

zyxelzywall_110_firmwareMatch-

AND

zyxelzywall_110Match-

Node

zyxelzywall_1100Match-

AND

zyxelzywall_1100_firmwareMatch-

Node

zyxelzywall_310Match-

AND

zyxelzywall_310_firmwareMatch-

Node

zyxelzywall_vpn_50Match-

AND

zyxelzywall_vpn_50_firmwareMatch-

Node

zyxelzywall_vpn_100_firmwareMatch-

AND

zyxelzywall_vpn_100Match-

Node

zyxelzywall_vpn_300_firmwareMatch-

AND

zyxelzywall_vpn_300Match-

Node

zyxelusg_20w_firmwareMatch-

AND

zyxelusg_20wMatch-

Node

zyxelusg_40_firmwareMatch-

AND

zyxelusg_40Match-

Node

zyxelusg_40w_firmwareMatch-

AND

zyxelusg_40wMatch-

Node

zyxelusg_60_firmwareMatch-

AND

zyxelusg_60Match-

Node

zyxelusg_60wMatch-

AND

zyxelusg_60w_firmwareMatch-

Node

zyxelusg_110Match-

AND

zyxelusg_110_firmwareMatch-

Node

zyxelusg_2200-vpnMatch-

AND

zyxelusg_2200-vpn_firmwareMatch-

Node

zyxelusg_310Match-

AND

zyxelusg_310_firmwareMatch-

Node

zyxelusg_1100_firmwareMatch-

AND

zyxelusg_1100Match-

Node

zyxelusg_1900_firmwareMatch-

AND

zyxelusg_1900Match-

Node

zyxelusg_20w-vpnMatch-

AND

zyxelusg_20w-vpn_firmwareMatch-

CPENameOperatorVersion
zyxel:zywall_110_firmwarezyxel zywall 110 firmwareeq-

CPE	Name	Operator	Version
zyxel:zywall_110_firmware	zyxel zywall 110 firmware	eq	-

References

ftp://ftp.zyxel.com/USG110/firmware/USG110_4.32%28AAPH.0%29C0_2.pdf

web-in-security.blogspot.com/2018/08/practical-bleichenbacher-attacks-on-ipsec-ike.html

www.zyxel.com/support/bleichenbacher_attack_vulnerability.shtml

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.0%

JSON

Related for CVE-2018-9129

cvelist1 nvd1 prion1 threatpost1