CVE-2019-15800
Estado: ModificadaCrítica (9.8)—
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to finally use these vulnerabilities to gain code execution.)
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 3.87%
- Percentil entre todas las CVEs puntuadas: 90
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
CWE
- CWE-78
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-15800",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2019-11-14T21:15:11.687",
"references": [
{
"url": "https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to finally use these vulnerabilities to gain code execution.)"
},
{
"lang": "es",
"value": "Se descubrió un problema en los dispositivos Zyxel GS1900 con firmware anterior a 2.50 (AAHH.0) C0. Debido a la falta de validación de entrada en las funciones cmd_sys_traceroute_exec (), cmd_sys_arp_clear () y cmd_sys_ping_exec () en la biblioteca libclicmd.so contenida en el firmware, un atacante podría aprovechar estas funciones para llamar al sistema () y ejecutar comandos arbitrarios en los conmutadores . (Tenga en cuenta que estas funciones no se invocan actualmente en esta versión del firmware, sin embargo, un atacante podría usar otras vulnerabilidades para finalmente usar estas vulnerabilidades para obtener la ejecución del código)."
}
],
"lastModified": "2026-06-17T02:21:05.997",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5428A26-563D-47A7-A771-D6F20775EDF5",
"versionEndExcluding": "2.50\\(aahh.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-8:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "51D33F50-B5A4-4AEF-972C-7FF089C21D52"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E6DB241-5659-414E-856E-C5D790D07F8B",
"versionEndExcluding": "2.50\\(aahi.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-8hp:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "27602862-EFB7-402B-994E-254A0B210820"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21D9999F-C55E-4BAB-A401-007FB34B2A5E",
"versionEndExcluding": "2.50\\(aazi.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-10hp:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "89201505-07AF-4F9C-9304-46F2707DB9B4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52D51F8F-8BCB-4571-A782-264B71C7CD76",
"versionEndExcluding": "2.50\\(aahj.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-16:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5078F7A5-D03B-4D3A-9C19-57DFF4D6BF7A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3687A400-9D7F-453A-88D7-C87B85B6E4EB",
"versionEndExcluding": "2.50\\(aahk.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-24e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A6456AD6-8A1D-4D3D-AC1A-ABE442242B1B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6733BECF-F9A3-4748-8A96-DFB10A670C35",
"versionEndExcluding": "2.50\\(aahl.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-24:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4F55299-70D5-4CE1-A1EC-D79B469B94F7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-24hp_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D3A3C5E-2027-40EE-A9EF-983474E9DC07",
"versionEndExcluding": "2.50\\(aahm.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-24hp:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "74B1D264-99AC-4AA8-955C-602F2DA5B885"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45D88D78-F7C9-45BB-8E47-2BD24B8616B2",
"versionEndExcluding": "2.50\\(aahn.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-48:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CFB7D4BF-7D17-48D3-990D-4BADAC8BD868"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-48hp_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C6EA6D9E-B5D4-4043-90C5-409B5875A3B5",
"versionEndExcluding": "2.50\\(aaho.0\\)c0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-48hp:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "566A9E8C-AF55-4331-B9B0-F65EB900B0BE"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}