CVE-2017-18374 — Hard-coded Credentials in Zyxel P660hn-t1a V1 Firmware

CWE-798 — Hard-coded Credentials3 documents3 sources
Severity
8.8HIGHNVD
EPSS
5.2%
top 10.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Billion 5200w-t FirmwareZyxel P660hn-t1a V1 FirmwareZyxel P660hn-t1a V2 Firmware
Timeline
PublishedMay 2
Latest updateMay 24

Description

The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a hardcoded service account with the username true and password true. These accounts can be used to login to the web interface, exploit authenticated command injections and change router settings for malicious purposes.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

🔴Vulnerability Details

2
GHSA
GHSA-3r7r-mrpq-cx9g: The ZyXEL P660HN-T1A v1 TCLinux Fw $7↗2022-05-24
▶
CVEList
CVE-2017-18374: The ZyXEL P660HN-T1A v1 TCLinux Fw $7↗2019-05-02
▶
CVE-2017-18374 — Hard-coded Credentials in Zyxel | cvebase