Lucene search

[email protected]NVD:CVE-2022-0823

HistoryJun 09, 2022 - 4:15 p.m.

CVE-2022-0823

2022-06-0916:15:08

CWE-203

[email protected]

web.nvd.nist.gov

zyxel

gs1200

switches

interaction control

vulnerability

local attacker

password guessing

timing side-channel

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

24.2%

JSON

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack.

Affected configurations

Nvd

Node

zyxelgs1200-5_firmwareRange<2.00\(abkm.1\)

AND

zyxelgs1200-5Match-

Node

zyxelgs1200-5hp_firmwareRange<2.00\(abkn.1\)

AND

zyxelgs1200-5hpMatch-

Node

zyxelgs1200-8_firmwareRange<2.00\(abme.1\)

AND

zyxelgs1200-8Match-

Node

zyxelgs1200-8hp_firmwareRange<2.00\(abmf.1\)

AND

zyxelgs1200-8hpMatch-

VendorProductVersionCPE
zyxelgs1200-5_firmware*cpe:2.3:o:zyxel:gs1200-5_firmware:*:*:*:*:*:*:*:*
zyxelgs1200-5-cpe:2.3:h:zyxel:gs1200-5:-:*:*:*:*:*:*:*
zyxelgs1200-5hp_firmware*cpe:2.3:o:zyxel:gs1200-5hp_firmware:*:*:*:*:*:*:*:*
zyxelgs1200-5hp-cpe:2.3:h:zyxel:gs1200-5hp:-:*:*:*:*:*:*:*
zyxelgs1200-8_firmware*cpe:2.3:o:zyxel:gs1200-8_firmware:*:*:*:*:*:*:*:*
zyxelgs1200-8-cpe:2.3:h:zyxel:gs1200-8:-:*:*:*:*:*:*:*
zyxelgs1200-8hp_firmware*cpe:2.3:o:zyxel:gs1200-8hp_firmware:*:*:*:*:*:*:*:*
zyxelgs1200-8hp-cpe:2.3:h:zyxel:gs1200-8hp:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zyxel	gs1200-5_firmware	*	cpe:2.3:o:zyxel:gs1200-5_firmware::::::::
zyxel	gs1200-5	-	cpe:2.3:h:zyxel:gs1200-5:-:::::::*
zyxel	gs1200-5hp_firmware	*	cpe:2.3:o:zyxel:gs1200-5hp_firmware::::::::
zyxel	gs1200-5hp	-	cpe:2.3:h:zyxel:gs1200-5hp:-:::::::*
zyxel	gs1200-8_firmware	*	cpe:2.3:o:zyxel:gs1200-8_firmware::::::::
zyxel	gs1200-8	-	cpe:2.3:h:zyxel:gs1200-8:-:::::::*
zyxel	gs1200-8hp_firmware	*	cpe:2.3:o:zyxel:gs1200-8hp_firmware::::::::
zyxel	gs1200-8hp	-	cpe:2.3:h:zyxel:gs1200-8hp:-:::::::*

References

www.zyxel.com/support/Zyxel-security-advisory-for-password-guessing-vulnerability-of-GS1200-series-switches.shtml

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

24.2%

JSON

Related for NVD:CVE-2022-0823

cve1 prion1 cvelist1 thn1