CVE-2021-35036

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-01 · updated 2026-06-17
Weakness: CWE-312

Description

A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated attacker to obtain sensitive information from the configuration file.

Affected products

Zyxel AX7501-B0 firmware: before 5.17\(abpc.2\)c0 — fixed in 5.17\(abpc.2\)c0
Zyxel DX3301-T0 firmware: before 5.50\(abvy.3\)c0 — fixed in 5.50\(abvy.3\)c0
Zyxel DX5401-B0 firmware: before 5.17\(abyo.2\)c0 — fixed in 5.17\(abyo.2\)c0
Zyxel Emg3525-T50B Firmware: before 5.50\(abpm.7\)c0 — fixed in 5.50\(abpm.7\)c0
Zyxel Emg5523-T50B Firmware: before 5.50\(abpm.7\)c0 — fixed in 5.50\(abpm.7\)c0
Zyxel Emg5723-T50K Firmware: before 5.50\(abom.8\)c0 — fixed in 5.50\(abom.8\)c0
Zyxel Ep240P Firmware: before 5.40\(abvh.0\)c0a03 — fixed in 5.40\(abvh.0\)c0a03
Zyxel Ex5401-B0 Firmware: before 5.17\(abyo.2\)c0 — fixed in 5.17\(abyo.2\)c0
Zyxel Ex5501-B0 Firmware: before 5.17\(abry.3\)c0 — fixed in 5.17\(abry.3\)c0
Zyxel Lte3301-Plus Firmware: before 1.00\(abqu.6\)c0 — fixed in 1.00\(abqu.6\)c0
Zyxel Lte5388-M804 Firmware: before 1.00\(abra.6\)c0 — fixed in 1.00\(abra.6\)c0
Zyxel Lte5388-S905 Firmware: before 1.00\(abvi.6\)c0 — fixed in 1.00\(abvi.6\)c0
Zyxel Lte5398-M904 Firmware: before 1.00\(abqv.2\)c0 — fixed in 1.00\(abqv.2\)c0
Zyxel Lte7240-M403 Firmware: before 2.00\(abmg.6\)c0 — fixed in 2.00\(abmg.6\)c0
Zyxel Lte7461-M602 Firmware: before 2.00\(abqn.6\)c0 — fixed in 2.00\(abqn.6\)c0
Zyxel Lte7480-M804 Firmware: before 1.00\(abra.6\)c0 — fixed in 1.00\(abra.6\)c0
Zyxel Lte7480-S905 Firmware: before 2.00\(abqt.6\)c0 — fixed in 2.00\(abqt.6\)c0
Zyxel Lte7485-S905 Firmware: before 1.00\(abvn.6\)c0 — fixed in 1.00\(abvn.6\)c0
Zyxel Lte7490-M804 Firmware: before v1.00\(abqy.5\)c0 — fixed in v1.00\(abqy.5\)c0
Zyxel Nr5101 Firmware: before 1.00\(abvc.6\)c0 — fixed in 1.00\(abvc.6\)c0
Zyxel NR7101 firmware: before 1.00\(abuv.7\)c0 — fixed in 1.00\(abuv.7\)c0
Zyxel Nr7102 Firmware: before 1.00\(abyd.2\)c0 — fixed in 1.00\(abyd.2\)c0
Zyxel Pm7300-T0 Firmware: before 5.42\(acbc.1\)c0 — fixed in 5.42\(acbc.1\)c0
Zyxel Pmg5317-T20B Firmware: before 5.40\(abki.4\)c0 — fixed in 5.40\(abki.4\)c0
Zyxel Pmg5617-T20B2 Firmware: before 5.41\(acbb.1\)c0 — fixed in 5.41\(acbb.1\)c0
Zyxel Pmg5617Ga Firmware: before 5.40\(abna.2\)c0 — fixed in 5.40\(abna.2\)c0
Zyxel Pmg5622Ga Firmware: before 5.40\(abnb.2\)c0 — fixed in 5.40\(abnb.2\)c0
Zyxel VMG3625-T50B firmware: before 5.50\(abtl.0\)b2r; before 5.50\(accr.0\)b4; before 5.50\(abpm.7\)c0 — fixed in 5.50\(abpm.7\)c0, 5.50\(abtl.0\)b2r, 5.50\(accr.0\)b4
Zyxel Vmg3927-T50K Firmware: before 5.50\(abom.8\)c0 — fixed in 5.50\(abom.8\)c0
Zyxel Vmg8623-T50B Firmware: before 5.50\(abpm.7\)c0 — fixed in 5.50\(abpm.7\)c0

How to fix

Upgrade to a fixed version: Zyxel AX7501-B0 firmware 5.17\(abpc.2\)c0; Zyxel DX3301-T0 firmware 5.50\(abvy.3\)c0; Zyxel DX5401-B0 firmware 5.17\(abyo.2\)c0; Zyxel Emg3525-T50B Firmware 5.50\(abpm.7\)c0; Zyxel Emg5523-T50B Firmware 5.50\(abpm.7\)c0; Zyxel Emg5723-T50K Firmware 5.50\(abom.8\)c0; Zyxel Ep240P Firmware 5.40\(abvh.0\)c0a03; Zyxel Ex5401-B0 Firmware 5.17\(abyo.2\)c0; Zyxel Ex5501-B0 Firmware 5.17\(abry.3\)c0; Zyxel Lte3301-Plus Firmware 1.00\(abqu.6\)c0; Zyxel Lte5388-M804 Firmware 1.00\(abra.6\)c0; Zyxel Lte5388-S905 Firmware 1.00\(abvi.6\)c0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-35036 or the next vulnerability affects your stack