Sign-up

ID

VAR-202112-2003


CVE

CVE-2021-35035


TITLE

Zyxel NBG6604 Information Disclosure Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2022-01683 // CNNVD: CNNVD-202112-2764

DESCRIPTION

A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive information from the configuration file. The Zyxel NBG6604 is a dual-band wireless router from China's Zyxel Technology (Zyxel)

Trust: 2.25

sources: NVD: CVE-2021-35035 // JVNDB: JVNDB-2021-017319 // CNVD: CNVD-2022-01683 // VULMON: CVE-2021-35035

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-01683

AFFECTED PRODUCTS

vendor:zyxelmodel:nbg6604scope: - version: -

Trust: 1.4

vendor:zyxelmodel:nbg6604scope:ltversion:1.00\(abir.9\)c0

Trust: 1.0

vendor:zyxelmodel:nbg6604scope:eqversion:nbg6604 firmware

Trust: 0.8

vendor:zyxelmodel:nbg6604scope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2022-01683 // JVNDB: JVNDB-2021-017319 // NVD: CVE-2021-35035

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-35035
value: MEDIUM

Trust: 1.0

security@zyxel.com.tw: CVE-2021-35035
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-35035
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-01683
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202112-2764
value: MEDIUM

Trust: 0.6

VULMON: CVE-2021-35035
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-35035
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-01683
severity: MEDIUM
baseScore: 6.1
vectorString: AV:N/AC:L/AU:M/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.4
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-35035
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

security@zyxel.com.tw: CVE-2021-35035
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.2
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-35035
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-01683 // VULMON: CVE-2021-35035 // JVNDB: JVNDB-2021-017319 // CNNVD: CNNVD-202112-2764 // NVD: CVE-2021-35035 // NVD: CVE-2021-35035

PROBLEMTYPE DATA

problemtype:CWE-312

Trust: 1.0

problemtype:Plaintext storage of important information (CWE-312) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-017319 // NVD: CVE-2021-35035

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-2764

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202112-2764

PATCH

title:Zyxel security advisory for insufficient session expiration and cleartext storage of sensitive information vulnerabilities of NBG6604 home routerurl:https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-session-expiration-and-cleartext-storage-of-sensitive-information-vulnerabilities-of-nbg6604-home-router

Trust: 0.8

title:Patch for Zyxel NBG6604 Information Disclosure Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/312026

Trust: 0.6

title:Zyxel NBG6604 Repair measures for information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176848

Trust: 0.6

sources: CNVD: CNVD-2022-01683 // JVNDB: JVNDB-2021-017319 // CNNVD: CNNVD-202112-2764

EXTERNAL IDS

db:NVDid:CVE-2021-35035

Trust: 3.9

db:JVNDBid:JVNDB-2021-017319

Trust: 0.8

db:CNVDid:CNVD-2022-01683

Trust: 0.6

db:CS-HELPid:SB2022010307

Trust: 0.6

db:CNNVDid:CNNVD-202112-2764

Trust: 0.6

db:VULMONid:CVE-2021-35035

Trust: 0.1

sources: CNVD: CNVD-2022-01683 // VULMON: CVE-2021-35035 // JVNDB: JVNDB-2021-017319 // CNNVD: CNNVD-202112-2764 // NVD: CVE-2021-35035

REFERENCES

url:https://www.zyxel.com/support/zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_nbg6604_home_router.shtml

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-35035

Trust: 1.4

url:https://www.cybersecurity-help.cz/vdb/sb2022010307

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/312.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2022-01683 // VULMON: CVE-2021-35035 // JVNDB: JVNDB-2021-017319 // CNNVD: CNNVD-202112-2764 // NVD: CVE-2021-35035

SOURCES

db:CNVDid:CNVD-2022-01683
db:VULMONid:CVE-2021-35035
db:JVNDBid:JVNDB-2021-017319
db:CNNVDid:CNNVD-202112-2764
db:NVDid:CVE-2021-35035

LAST UPDATE DATE

2024-08-14T14:02:52.893000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-01683date:2022-01-07T00:00:00
db:VULMONid:CVE-2021-35035date:2022-01-07T00:00:00
db:JVNDBid:JVNDB-2021-017319date:2023-01-16T06:49:00
db:CNNVDid:CNNVD-202112-2764date:2022-01-10T00:00:00
db:NVDid:CVE-2021-35035date:2022-01-07T14:40:28.507

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-01683date:2021-12-31T00:00:00
db:VULMONid:CVE-2021-35035date:2021-12-29T00:00:00
db:JVNDBid:JVNDB-2021-017319date:2023-01-16T00:00:00
db:CNNVDid:CNNVD-202112-2764date:2021-12-29T00:00:00
db:NVDid:CVE-2021-35035date:2021-12-29T13:15:07.893