Strix
26.1K

CVE-2008-1526

HIGHCVSS 7.5/10EPSS 0.89%

Last modified

CVE-2008-1526 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.. EPSS estimates a 0.89% chance of exploitation in the next 30 days.

Description

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
0.89%

54.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ZyxelP-663hn-51 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-663hn-51 Firmware3.40\(pe9\)
ZyxelP-660h-61 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660h-61 Firmware3.40\(pe9\)
ZyxelP-660h-63 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660h-63 Firmware3.40\(pe9\)
ZyxelP-660h-67 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660h-67 Firmware3.40\(pe9\)
ZyxelP-660h-D1 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660h-D1 Firmware3.40\(pe9\)
ZyxelP-660h-D3 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660h-D3 Firmware3.40\(pe9\)
ZyxelP-660hn-51 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660hn-51 Firmware3.40\(pe9\)
ZyxelP-660h-T1 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660h-T1 Firmware3.40\(pe9\)
ZyxelP-660hw D1 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660hw D1 Firmware3.40\(pe9\)
ZyxelP-660hw D3 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660hw D3 Firmware3.40\(pe9\)
ZyxelP-660hw T3 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-660hw T3 Firmware3.40\(pe9\)
ZyxelP-661hnu-F1 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-661hnu-F1 Firmware3.40\(pe9\)
ZyxelP-661h Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-661h Firmware3.40\(pe9\)
ZyxelP-661hw-D1 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-661hw-D1 Firmware3.40\(pe9\)
ZyxelP-661hnu-F3 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-661hnu-F3 Firmware3.40\(pe9\)
ZyxelP-662hw-D3 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-662hw-D3 Firmware3.40\(pe9\)
ZyxelP-662hw-D Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-662hw-D Firmware3.40\(pe9\)
ZyxelP-662hw-D1 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-662hw-D1 Firmware3.40\(pe9\)
ZyxelP-662h-61 Firmware>= 3.40\(agd.2\), <= 3.40\(ahq.3\)
ZyxelP-662h-61 Firmware3.40\(pe9\)

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2008-1526?
ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.
How severe is CVE-2008-1526?
CVE-2008-1526 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.89% probability of exploitation in the next 30 days.
How do I fix CVE-2008-1526?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2008-1526?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST