CVEvulnerability

CVE-2024-38270

6.5 MEDIUM Published 2024-09-10 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-09-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-331

Description

An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive.

Affected configurations

• zyxel gs1900-48hpv2 firmware (< 2.80\(abtq.1\)c0) • zyxel gs1900-48 firmware (< 2.80\(aahn.1\)c0) • zyxel gs1900-24hpv2 firmware (< 2.80\(abtp.1\)c0) • zyxel gs1900-24ep firmware (< 2.80\(abto.1\)c0) • zyxel gs1900-24e firmware (<= 2.80\(aahk.1\)c0) • zyxel gs1900-24 firmware (<= 2.80\(aahl.1\)c0) • zyxel gs1900-16 firmware (< 2.80\(aahj.1\)c0) • zyxel gs1900-10hp firmware (< 2.80\(aazi.1\)c0) • zyxel gs1900-8hp firmware (< 2.80\(aahi.1\)c0) • zyxel gs1900-8 firmware (< 2.80\(aahh.1\)c0)

Related

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

References