Insufficient Entropy (CWE-331)
An insufficient entropy vulnerability exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0 due to improper use of a randomness function with low entropy for web authentication tokens generation. This vulnerability affects multiple Zyxel GS1900 series switches.
This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive. The potential impact is high for confidentiality, as an attacker could potentially access sensitive information or perform unauthorized actions with a stolen session token. However, there is no direct impact on integrity or availability of the system.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Zyxel has released updated firmware versions for the affected GS1900 series switches to address this vulnerability.
1. Update the firmware of all affected Zyxel GS1900 series switches to the latest version available from the vendor. 2. For GS1900-10HP, ensure the firmware is updated to a version newer than V2.80(AAZI.0)C0. 3. Implement network segmentation to restrict access to the affected devices from untrusted networks. 4. Monitor for suspicious activities or unauthorized access attempts on the network. 5. Implement strong authentication mechanisms and session management practices. 6. Regularly review and terminate inactive sessions to reduce the attack surface.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD published the first details for CVE-2024-38270
Feedly found the first article mentioning CVE-2024-38270. See article
Feedly estimated the CVSS score as HIGH
A CVSS base score of 5.3 has been assigned.
EPSS Score was set to: 0.05% (Percentile: 21.3%)
A CVSS base score of 6.5 has been assigned.