Cyber Resilience

CVE-2021-35036

Medium

Published: 01 March 2022

Published
01 March 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0015 35.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-35036 is a medium-severity Cleartext Storage of Sensitive Information (CWE-312) vulnerability in Zyxel Vmg3625-T50B Firmware. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated attacker to obtain sensitive information from the configuration file.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

zyxel
ax7501-b0 firmware
≤ 5.17\(abpc.2\)c0
zyxel
dx3301-t0 firmware
≤ 5.50\(abvy.3\)c0
zyxel
dx5401-b0 firmware
≤ 5.17\(abyo.2\)c0
zyxel
emg3525-t50b firmware
≤ 5.50\(abpm.7\)c0
zyxel
emg5523-t50b firmware
≤ 5.50\(abpm.7\)c0
zyxel
emg5723-t50k firmware
≤ 5.50\(abom.8\)c0
zyxel
ep240p firmware
≤ 5.40\(abvh.0\)c0a03
zyxel
ex5401-b0 firmware
≤ 5.17\(abyo.2\)c0
zyxel
ex5501-b0 firmware
≤ 5.17\(abry.3\)c0
zyxel
lte3301-plus firmware
≤ 1.00\(abqu.6\)c0
+21 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-312

Training on secure data handling discourages cleartext storage of sensitive information.

addresses: CWE-312

Data action mapping can detect storage actions that leave sensitive information in cleartext.

addresses: CWE-312

Configuration policies can mandate secure storage methods to avoid cleartext storage of sensitive information.

addresses: CWE-312

Policy requires protection measures such as encryption for sensitive data stored on media, preventing cleartext exposure.

addresses: CWE-312

Key-management policy requires protected storage of key material, preventing cleartext storage of sensitive cryptographic keys.

addresses: CWE-312

Requiring confidentiality protection for information at rest eliminates cleartext storage of sensitive data on persistent media.

addresses: CWE-312

Reduces cleartext storage of sensitive data when OPSEC identifies and mandates protection of key information artifacts.

References