CVE-2008-1526

Published: Mar 26, 2008Modified: Apr 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.

Affected (38)

Products: Zyxel: P 663hn 51 Firmware, P 660h 61 Firmware, P 660h 63 Firmware, P 660h 67 Firmware, P 660h D1 Firmware, P 660h D3 Firmware, P 660hn 51 Firmware, P 660h T1 Firmware, P 660hw D1 Firmware, P 660hw D3 Firmware, P 660hw T3 Firmware, P 661hnu F1 Firmware, P 661h Firmware, P 661hw D1 Firmware, P 661hnu F3 Firmware, P 662hw D3 Firmware, P 662hw D Firmware, P 662hw D1 Firmware, P 662h 61 Firmware

19 products

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 663hn 51 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 663hn 51 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 663hn 51	All versions

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660h 61 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660h 61 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660h 61	All versions

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660h 63 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660h 63 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660h 63	All versions

Configuration D

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660h 67 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660h 67 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660h 67	All versions

Configuration E

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660h D1 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660h D1 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660h D1	All versions

Configuration F

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660h D3 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660h D3 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660h D3	All versions

Configuration G

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660hn 51 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660hn 51 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660hn 51	All versions

Configuration H

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660h T1 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660h T1 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660h T1	All versions

Configuration I

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660hw D1 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660hw D1 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660hw D1	All versions

Configuration J

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660hw D3 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660hw D3 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660hw D3	All versions

Configuration K

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 660hw T3 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 660hw T3 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 660hw T3	All versions

Configuration L

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 661hnu F1 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 661hnu F1 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 661hnu F1	All versions

Configuration M

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 661h Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 661h Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 661h	All versions

Configuration N

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 661hw D1 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 661hw D1 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 661hw D1	All versions

Configuration O

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 661hnu F3 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 661hnu F3 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 661hnu F3	All versions

Configuration P

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 662hw D3 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 662hw D3 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 662hw D3	All versions

Configuration Q

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 662hw D Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 662hw D Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 662hw D	All versions

Configuration R

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 662hw D1 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 662hw D1 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 662hw D1	All versions

Configuration S

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel P 662h 61 Firmware	From 3.40\(agd.2\) to 3.40\(ahq.3\)
Zyxel P 662h 61 Firmware	Version 3.40(pe9)

Running on/with	Platform Versions
Zyxel P 662h 61	All versions

Related CWEs

CWE-916

Use of Password Hash With Insufficient Computational Effort

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

References (6)

http://www.gnucitizen.org/projects/router-hacking-challenge/

Source: cve@mitre.org

Broken Link

http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/archive/1/489009/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.gnucitizen.org/projects/router-hacking-challenge/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.securityfocus.com/archive/1/489009/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

Timeline

No history available yet.