Skip to main content

Password in Configuration File

CVE-2021-35033

High
7.8/10

Summary

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • HIGH

CWE-260 - Password in Configuration File

The software stores a password in a configuration file that might be accessible to actors who do not know the password.

References

Advisory Timeline

  • Published