What is the CVSS score of CVE-2015-7256?

CVE-2015-7256 has a CVSS 3.0 base score of 5.9 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Nwa1100 N Firmware CVE-2015-7256

MEDIUM

Cryptographic Issues (CWE-310)

2017-09-28 cret@cert.org

Zyxel Information Disclosure Nwa1100 N Firmware Nwa1100 Nh Firmware Nwa1121 Ni Firmware Nwa1123 Ac Firmware Nwa1123 Ni Firmware P 660Hn 51 Firmware P 663Hn 51 Firmware Vmg1312 B10A Firmware Vmg1312 B30A Firmware Vmg1312 B30B Firmware Vmg4380 B10A Firmware Vmg8324 B10A Firmware Vmg8924 B10A Firmware Vmg8924 B30A Firmware Vsg1435 B101 Firmware Pmg5318 B20A Firmware Sbg3300 N000 Firmware Sbg3300 Nb00 Firmware Sbg3500 N000 Firmware Gs1900 8 Firmware Gs1900 24 Firmware C1000Z Firmware Q1000 Firmware Fr1000Z Firmware P8702N Firmware

5.9

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 28, 2017 - 01:29 cve.org

MEDIUM 5.9

DescriptionCVE.org

ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, VMG8924-B30A, and VSG1435-B101 DSL CPEs; PMG5318-B20A GPONs; SBG3300-N000, SBG3300-NB00, and SBG3500-N000 small business gateways; GS1900-8 and GS1900-24 switches; and C1000Z, Q1000, FR1000Z, and P8702N project models use non-unique X.509 certificates and SSH host keys.

AnalysisAI

ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A,. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, VMG8924-B30A, and VSG1435-B101 DSL CPEs; PMG5318-B20A GPONs; SBG3300-N000, SBG3300-NB00, and SBG3500-N000 small business gateways; GS1900-8 and GS1900-24 switches; and C1000Z, Q1000, FR1000Z, and P8702N project models use non-unique X.509 certificates and SSH host keys. Affected products include: Zyxel Nwa1100-N Firmware, Zyxel Nwa1100-Nh Firmware, Zyxel Nwa1121-Ni Firmware, Zyxel Nwa1123-Ac Firmware, Zyxel Nwa1123-Ni Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.