Vulnerabilities > CVE-2008-1526 - Use of Password Hash With Insufficient Computational Effort vulnerability in Zyxel products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

zyxel

CWE-916

NVD

Published: 2008-03-26

Updated: 2024-11-21

Summary

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.

Vulnerable Configurations

Part	Description	Count
OS	Zyxel Zyxel P 663Hn 51 Firmware 3.40\(Agd.2\) Zyxel P 663Hn 51 Firmware 3.40\(Ahq.3\) Zyxel P 663Hn 51 Firmware 3.40\(Pe9\) Zyxel P 660H 61 Firmware 3.40\(Agd.2\) Zyxel P 660H 61 Firmware 3.40\(Ahq.3\) Zyxel P 660H 61 Firmware 3.40\(Pe9\) Zyxel P 660H 63 Firmware 3.40\(Agd.2\) Zyxel P 660H 63 Firmware 3.40\(Ahq.3\) Zyxel P 660H 63 Firmware 3.40\(Pe9\) Zyxel P 660H 67 Firmware 3.40\(Agd.2\) Zyxel P 660H 67 Firmware 3.40\(Ahq.3\) Zyxel P 660H 67 Firmware 3.40\(Pe9\) Zyxel P 660H D1 Firmware 3.40\(Agd.2\) Zyxel P 660H D1 Firmware 3.40\(Ahq.3\) Zyxel P 660H D1 Firmware 3.40\(Pe9\) Zyxel P 660H D3 Firmware 3.40\(Agd.2\) Zyxel P 660H D3 Firmware 3.40\(Ahq.3\) Zyxel P 660H D3 Firmware 3.40\(Pe9\) Zyxel P 660Hn 51 Firmware 3.40\(Agd.2\) Zyxel P 660Hn 51 Firmware 3.40\(Ahq.3\) Zyxel P 660Hn 51 Firmware 3.40\(Pe9\) Zyxel P 660H T1 Firmware 3.40\(Agd.2\) Zyxel P 660H T1 Firmware 3.40\(Ahq.3\) Zyxel P 660H T1 Firmware 3.40\(Pe9\) Zyxel P 660Hw D1 Firmware 3.40\(Agd.2\) Zyxel P 660Hw D1 Firmware 3.40\(Ahq.3\) Zyxel P 660Hw D1 Firmware 3.40\(Pe9\) Zyxel P 660Hw D3 Firmware 3.40\(Agd.2\) Zyxel P 660Hw D3 Firmware 3.40\(Ahq.3\) Zyxel P 660Hw D3 Firmware 3.40\(Pe9\) Zyxel P 660Hw T3 Firmware 3.40\(Agd.2\) Zyxel P 660Hw T3 Firmware 3.40\(Ahq.3\) Zyxel P 660Hw T3 Firmware 3.40\(Pe9\) Zyxel P 661Hnu F1 Firmware 3.40\(Agd.2\) Zyxel P 661Hnu F1 Firmware 3.40\(Ahq.3\) Zyxel P 661Hnu F1 Firmware 3.40\(Pe9\) Zyxel P 661H Firmware 3.40\(Agd.2\) Zyxel P 661H Firmware 3.40\(Ahq.3\) Zyxel P 661H Firmware 3.40\(Pe9\) Zyxel P 661Hw D1 Firmware 3.40\(Agd.2\) Zyxel P 661Hw D1 Firmware 3.40\(Ahq.3\) Zyxel P 661Hw D1 Firmware 3.40\(Pe9\) Zyxel P 661Hnu F3 Firmware 3.40\(Agd.2\) Zyxel P 661Hnu F3 Firmware 3.40\(Ahq.3\) Zyxel P 661Hnu F3 Firmware 3.40\(Pe9\) Zyxel P 662Hw D3 Firmware 3.40\(Agd.2\) Zyxel P 662Hw D3 Firmware 3.40\(Ahq.3\) Zyxel P 662Hw D3 Firmware 3.40\(Pe9\) Zyxel P 662Hw D Firmware 3.40\(Agd.2\) Zyxel P 662Hw D Firmware 3.40\(Ahq.3\) Zyxel P 662Hw D Firmware 3.40\(Pe9\) Zyxel P 662Hw D1 Firmware 3.40\(Agd.2\) Zyxel P 662Hw D1 Firmware 3.40\(Ahq.3\) Zyxel P 662Hw D1 Firmware 3.40\(Pe9\) Zyxel P 662H 61 Firmware 3.40\(Agd.2\) Zyxel P 662H 61 Firmware 3.40\(Ahq.3\) Zyxel P 662H 61 Firmware 3.40\(Pe9\)	57
Hardware	Zyxel Zyxel P 663Hn 51 - Zyxel P 660H 61 - Zyxel P 660H 63 - Zyxel P 660H 67 - Zyxel P 660H D1 - Zyxel P 660H D3 - Zyxel P 660Hn 51 - Zyxel P 660H T1 - Zyxel P 660Hw D1 - Zyxel P 660Hw D3 - Zyxel P 660Hw T3 - Zyxel P 661Hnu F1 - Zyxel P 661H - Zyxel P 661Hw D1 - Zyxel P 661Hnu F3 - Zyxel P 662Hw D3 - Zyxel P 662Hw D - Zyxel P 662Hw D1 - Zyxel P 662H 61 -	19

Common Weakness Enumeration (CWE)

CWE-916 - Use of Password Hash With Insufficient Computational Effort

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References