CVE-2024-38270

Insufficient Entropy (CWE-331)

Published: Sep 10, 2024 / Updated: 2mo ago

010
CVSS 6.5EPSS 0.05%Medium
CVE info copied to clipboard

Summary

An insufficient entropy vulnerability exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0 due to improper use of a randomness function with low entropy for web authentication tokens generation. This vulnerability affects multiple Zyxel GS1900 series switches.

Impact

This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive. The potential impact is high for confidentiality, as an attacker could potentially access sensitive information or perform unauthorized actions with a stolen session token. However, there is no direct impact on integrity or availability of the system.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Zyxel has released updated firmware versions for the affected GS1900 series switches to address this vulnerability.

Mitigation

1. Update the firmware of all affected Zyxel GS1900 series switches to the latest version available from the vendor. 2. For GS1900-10HP, ensure the firmware is updated to a version newer than V2.80(AAZI.0)C0. 3. Implement network segmentation to restrict access to the affected devices from untrusted networks. 4. Monitor for suspicious activities or unauthorized access attempts on the network. 5. Implement strong authentication mechanisms and session management practices. 6. Regularly review and terminate inactive sessions to reduce the attack surface.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Timeline

CVE Assignment

NVD published the first details for CVE-2024-38270

Sep 10, 2024 at 2:15 AM
First Article

Feedly found the first article mentioning CVE-2024-38270. See article

Sep 10, 2024 at 2:17 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 10, 2024 at 2:17 AM
CVSS

A CVSS base score of 5.3 has been assigned.

Sep 10, 2024 at 2:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 21.3%)

Sep 10, 2024 at 9:56 AM
CVSS

A CVSS base score of 6.5 has been assigned.

Sep 18, 2024 at 6:25 PM / nvd
Static CVE Timeline Graph

Affected Systems

Zyxel/gs1900-24hpv2_firmware
+null more

Patches

www.zyxel.com
+null more

Attack Patterns

CAPEC-59: Session Credential Falsification through Prediction
+null more

References

Zyxel security advisory for insufficient entropy vulnerability for web authentication tokens generation in GS1900 series switches
An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation was found in the Zyxel GS1900 series switch firmware. CVE: CVE-2024-38270 Summary Zyxel has released patches for GS1900 series switches affected by an insufficient entropy vulnerability.

News

Medium - CVE-2024-38270 - An insufficient entropy vulnerability caused by...
An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version...
null
- MEDIUM - CVE-2024-38270 An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive.
Steinar H. Gunderson: GS1900-10HP web session hijack
As long as one assumes that the administrator logged in less than a day ago, the entire range of possible seeds it contained within the range [now - 86400, now + 999999], i.e. only about 1.1M possible cookies, which can simply be tried serially even if one did not observe the original login. This means that if an attacker knows precisely when the administrator logged in (for instance, by observing a HTTPS login on the network), they will have a very limited range of possible tokens to check.
GS1900-10HP web session hijack
As long as one assumes that the administrator logged in less than a day ago, the entire range of possible seeds it contained within the range [now - 86400, now + 999999], i.e. only about 1.1M possible cookies, which can simply be tried serially even if one did not observe the original login. This means that if an attacker knows precisely when the administrator logged in (for instance, by observing a HTTPS login on the network), they will have a very limited range of possible tokens to check.
CVE-2024-38270 | Zyxel GS1900-10HP V2.80(AAZI.0)C0 entropy
A vulnerability classified as problematic has been found in Zyxel GS1900-10HP V2.80(AAZI.0)C0 . Affected is an unknown function. The manipulation leads to insufficient entropy. This vulnerability is traded as CVE-2024-38270 . Access to the local network is required for this attack. There is no exploit available.
See 7 more articles and social media posts

CVSS V3.1

Attack Vector:Adjacent_network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI