SB2022092603 - Insufficient Entropy in Zyxel GS1900 series switches

Description

This security bulletin contains information about 1 security vulnerability.

1) Insufficient Entropy (CVE-ID: CVE-2022-34746)

The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to improper use of randomness sources with low entropy for RSA key pair generation. A remote attacker can retrieve a private key.

Remediation

Install update from vendor's website.

References

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-of-gs1900-series-switches