CVE-2008-1160

ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attackers to…

published March 25, 2008

CVSS
—
EPSS
15%
Percentile
96.7
In the wild
Unconfirmed
What it is

🚨 A hard-coded password lives in your ZyXEL ZyWALL 1050! This sneaky little secret could let attackers gain privileges without you ever knowing. 😲 Think of it like a restaurant that never changes the key code to the safe where they store all the cash. Even if a new manager sets a security code, the old one still works, leaving the vault wide open! An attacker could stroll right in and take control, allowing them to manipulate settings or access sensitive information. This could lead to unauthorized changes that compromise your entire network's integrity!

Put simply

Think of it like a restaurant that never changes the key code to the safe where they store all the cash. Even if a new manager sets a security code, the old one still works, leaving the vault wide open! The vulnerability exists because the Quagga and Zebra processes use a hard-coded password that remains unchanged when user-specific settings are applied, allowing attackers to exploit it remotely.

What to do

An attacker could stroll right in and take control, allowing them to manipulate settings or access sensitive information. This could lead to unauthorized changes that compromise your entire network's integrity! Change any default passwords immediately and replace them with strong, unique ones. Regularly review your device settings and consider applying security patches if available. It's also worth checking for any updated firmware from ZyXEL. You’ve got this! Take these steps and you'll be on your way to securing your ZyWALL like a pro! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.14761 · 96.7th percentile
Published
2008-03-25T00:00Z
EPSS history
Timeline
  • 25 MAR 00:00Z
    ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attackers to…
    cvelistv5