CVE-2018-1164: zyxel p-870h-51_firmware
Vulnerability summary
CVE-2018-1164 is a high (CVSS 10.0) vulnerability in zyxel p-870h-51_firmware. EPSS estimates a 3.96% chance of exploitation in the next 30 days, higher than 90.3% of scored vulnerabilities.
Timeline
- 21-02-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by improper access controls that allow access to critical functions without authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-CAN-4540.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.96%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.96% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Zyxel2 products
- p-870h-51_firmware1.00\(awg.3\)d5
- zyxel p-870h-51 dsl router1.00(AWG.3)D5
1 vendor · 2 products