Skip to main content

Gs1900 10Hp Firmware CVE-2024-38270

MEDIUM
Insufficient Entropy (CWE-331)
2024-09-10 security@zyxel.com.tw
Information Disclosure Zyxel Gs1900 10Hp Firmware Gs1900 8 Firmware Gs1900 24 Firmware Gs1900 48Hpv2 Firmware Gs1900 8Hp Firmware Gs1900 16 Firmware Gs1900 24E Firmware Gs1900 24Ep Firmware Gs1900 24Hpv2 Firmware Gs1900 48 Firmware
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 10, 2024 - 02:15 nvd
MEDIUM 6.5

DescriptionNVD

An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive.

AnalysisAI

An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-331. An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive. Affected products include: Zyxel Gs1900-48Hpv2 Firmware, Zyxel Gs1900-48 Firmware, Zyxel Gs1900-24Hpv2 Firmware, Zyxel Gs1900-24Ep Firmware, Zyxel Gs1900-24E Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Gs1900 10Hp Firmware

View all
CVE-2019-15800 CRITICAL POC
9.8 Nov 14

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Rated critical severity (CVSS 9.8),
CVE-2019-15803 CRITICAL POC
9.1 Nov 14

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Rated critical severity (CVSS 9.1),
CVE-2019-15799 HIGH POC
8.8 Nov 14

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Rated high severity (CVSS 8.8), thi
CVE-2019-15804 HIGH POC
7.5 Nov 14

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Rated high severity (CVSS 7.5), thi
CVE-2019-15801 HIGH POC
7.5 Nov 14

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Rated high severity (CVSS 7.5), thi
CVE-2015-5989 CRITICAL
9.8 Dec 31

Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remot
CVE-2016-1329 CRITICAL
9.8 Mar 03

Cisco NX-OS 6.0(2)U6(1) through 6.0(2)U6(5) on Nexus 3000 devices and 6.0(2)A6(1) through 6.0(2)A6(5) and 6.0(2)A7(1) on
CVE-2015-5988 CRITICAL
9.8 Dec 31

The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote
CVE-2019-15802 MEDIUM POC
5.9 Nov 14

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Rated medium severity (CVSS 5.9), t
CVE-2026-7273 HIGH
8.8 Jun 16

Remote code execution in Zyxel GS1900 series managed switches (including GS1900-48HPv2, GS1900-8, GS1900-8HP, GS1900-10H
CVE-2016-1302 HIGH
8.8 Feb 07

Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) an
CVE-2015-5990 HIGH
8.8 Dec 31

Cross-site request forgery (CSRF) vulnerability on Belkin F9K1102 2 devices with firmware 2.10.17 allows remote attacker

Same weakness CWE-331 – Insufficient Entropy

View all
CVE-2025-47781 CRITICAL POC
9.8
CVE-2020-36925 CRITICAL POC
9.8
CVE-2023-49599 CRITICAL POC
9.8
CVE-2024-36400 CRITICAL POC
9.8
CVE-2022-34294 CRITICAL POC
9.8
CVE-2020-12735 CRITICAL POC
9.8
CVE-2026-71851 CRITICAL POC
9.0
CVE-2026-22698 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2024-38270 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy