CVE-2019-15801

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-14 · updated 2026-06-17
Weakness: CWE-798

Description

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0.

Affected products

Zyxel GS1900-10HP firmware: before 2.50\(aazi.0\)c0 — fixed in 2.50\(aazi.0\)c0
Zyxel GS1900-16 firmware: before 2.50\(aahj.0\)c0 — fixed in 2.50\(aahj.0\)c0
Zyxel GS1900-24 firmware: before 2.50\(aahl.0\)c0 — fixed in 2.50\(aahl.0\)c0
Zyxel GS1900-24E firmware: before 2.50\(aahk.0\)c0 — fixed in 2.50\(aahk.0\)c0
Zyxel Gs1900-24Hp Firmware: before 2.50\(aahm.0\)c0 — fixed in 2.50\(aahm.0\)c0
Zyxel GS1900-48 firmware: before 2.50\(aahn.0\)c0 — fixed in 2.50\(aahn.0\)c0
Zyxel Gs1900-48Hp Firmware: before 2.50\(aaho.0\)c0 — fixed in 2.50\(aaho.0\)c0
Zyxel GS1900-8 firmware: before 2.50\(aahh.0\)c0 — fixed in 2.50\(aahh.0\)c0
Zyxel GS1900-8HP firmware: before 2.50\(aahi.0\)c0 — fixed in 2.50\(aahi.0\)c0

How to fix

Upgrade to a fixed version: Zyxel GS1900-10HP firmware 2.50\(aazi.0\)c0; Zyxel GS1900-16 firmware 2.50\(aahj.0\)c0; Zyxel GS1900-24 firmware 2.50\(aahl.0\)c0; Zyxel GS1900-24E firmware 2.50\(aahk.0\)c0; Zyxel Gs1900-24Hp Firmware 2.50\(aahm.0\)c0; Zyxel GS1900-48 firmware 2.50\(aahn.0\)c0; Zyxel Gs1900-48Hp Firmware 2.50\(aaho.0\)c0; Zyxel GS1900-8 firmware 2.50\(aahh.0\)c0; Zyxel GS1900-8HP firmware 2.50\(aahi.0\)c0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-15801 or the next vulnerability affects your stack