CVE-2015-7256

Vulnerability

Multiple ZyXEL devices, including access points (NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, NWA1123-NI), DSL CPEs (P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, VMG8924-B30A, VSG1435-B101), GPONs (PMG5318-B20A), small business gateways (SBG3300-N000, SBG3300-NB00, SBG3500-N000), switches (GS1900-8, GS1900-24), and project models (C1000Z, Q1000, FR1000Z, P8702N), use non-unique X.509 certificates and SSH host keys. This is a case of CWE-321: Use of Hard-coded Cryptographic Key. Affected firmware images contain identical keys or certificates across instances, often across product lines or even vendors due to common SDKs or OEM firmware [1].

Exploitation

An attacker with network access can perform impersonation, man-in-the-middle, or passive decryption attacks without authentication. No special privileges or user interaction is required beyond being on the network path. The attacker can obtain the hard-coded keys from any device of the same model or from unpacked firmware, then use them to impersonate another device, intercept traffic, or decrypt captured communications [1].

Impact

Successful exploitation allows a remote, unauthenticated attacker to carry out impersonation, man-in-the-middle, or passive decryption attacks. This can lead to exposure of sensitive information, including credentials and other data transmitted over supposedly secure channels. The compromise scope is network-level, affecting confidentiality and integrity of communications [1].

Mitigation

As of the available reference, the CERT/CC is unaware of a practical solution for most affected devices. Some vendors may provide updates or guidance, but no specific fixed version or release date is disclosed. Users are encouraged to check vendor information pages for individual products. If no fix exists, replacing the device or limiting network exposure may be considered [1].