Login Request a demo
Medium severity · published Aug 15, 2018
CVE-2018-9129
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections
5.9
CVSS
1%
EPSS
No
On KEV
Description
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
U1
Usg 110 Firmware · Zyxel
All versions, or not specified · source: NVD
U1
Usg 1100 Firmware · Zyxel
All versions, or not specified · source: NVD
U1
Usg 1900 Firmware · Zyxel
All versions, or not specified · source: NVD
U2
Usg 20w Firmware · Zyxel
All versions, or not specified · source: NVD
U2
Usg 20w-vpn Firmware · Zyxel
All versions, or not specified · source: NVD
U2
Usg 2200-vpn Firmware · Zyxel
All versions, or not specified · source: NVD
U3
Usg 310 Firmware · Zyxel
All versions, or not specified · source: NVD
U4
Usg 40 Firmware · Zyxel
All versions, or not specified · source: NVD
U4
Usg 40w Firmware · Zyxel
All versions, or not specified · source: NVD
U6
Usg 60 Firmware · Zyxel
All versions, or not specified · source: NVD
U6
Usg 60w Firmware · Zyxel
All versions, or not specified · source: NVD
Z1
Zywall 110 Firmware · Zyxel
All versions, or not specified · source: NVD
Affected product
U1
Usg 110 Firmware
Zyxel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-9129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-9129
Third Party Advisory
https://web-in-security.blogspot.com/2018/08/practical-bleichenbacher-attacks-on-ipsec-ike.html
Patch
https://www.zyxel.com/support/bleichenbacher_attack_vulnerability.shtml
More from Usg 110 Firmware
7.8
CVE-2022-26532
A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through…
7.8
CVE-2022-26531
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions…
6.5
CVE-2022-0910
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX…
6.1
CVE-2022-0734
A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50…