CVE-2022-34746
Last modified
CVE-2022-34746 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | Gs1900-8 Firmware | < 2.70\(aahh.3\)c0 |
| Zyxel | Gs1900-8hp Firmware | < 2.70\(aahi.3\)c0 |
| Zyxel | Gs1900-10hp Firmware | < 2.70\(aazi.3\)c0 |
| Zyxel | Gs1900-16 Firmware | < 2.70\(aahj.3\)c0 |
| Zyxel | Gs1900-24 Firmware | < 2.70\(aahl.3\)c0 |
| Zyxel | Gs1900-24e Firmware | < 2.70\(aahk.3\)c0 |
| Zyxel | Gs1900-24ep Firmware | < 2.70\(abto.3\)c0 |
| Zyxel | Gs1900-24hpv2 Firmware | < 2.70\(abtp.3\)c0 |
| Zyxel | Gs1900-48 Firmware | < 2.70\(aahn.3\)c0 |
| Zyxel | Gs1900-48hpv2 Firmware | < 2.70\(abtq.3\)c0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-34746?
How severe is CVE-2022-34746?
How do I fix CVE-2022-34746?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-34739The fingerprint module has a vulnerability of overflow in ar…7.5
- CVE-2022-3474A bad credential handling in the remote assets API for Bazel…4.3
- CVE-2022-34740The NFC module has a buffer overflow vulnerability. Successf…6.5
- CVE-2022-34741The NFC module has a buffer overflow vulnerability. Successf…6.5
- CVE-2022-34742The system module has a read/write vulnerability. Successful…7.5
- CVE-2022-34743The AT commands of the USB port have an out-of-bounds read v…7.5
- CVE-2022-34747A format string vulnerability in Zyxel NAS326 firmware versi…9.8
- CVE-2022-34748A vulnerability has been identified in Simcenter Femap (All …7.8
- CVE-2022-34749In mistune through 2.0.2, support of inline markup is implem…7.5
- CVE-2022-34750An issue was discovered in MediaWiki through 1.38.1. The lem…7.5
- CVE-2022-34753A CWE-78: Improper Neutralization of Special Elements used i…8.8
- CVE-2022-34754A CWE-269: Improper Privilege Management vulnerability exist…6.8
Are you affected by CVE-2022-34746?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST