CVE-2021-35033: zyxel nbg6818_firmware Password in Configuration File
Vulnerability summary
CVE-2021-35033 is a high (CVSS 7.8) Password in Configuration File vulnerability in zyxel nbg6818_firmware. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 23-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.41% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (tenable.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-260Password in Configuration FileThe product stores a password in a configuration file that might be accessible to actors who do not know the password.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Zyxel12 products
- nbg6818_firmware< 1.00\(absc.5\)c0
- nbg6818 series firmware1.00(ABSC.0)C0 through 1.00(ABSC.4)C0
- nbg7815_firmware< 1.00\(absk.7\)c0
- nbg7815 series firmware1.00(ABSK.0)C0 through 1.00(ABSK.6)C0
- wsq20_firmware< 1.00\(abof.11\)c0
1 vendor · 12 products