Cyber Resilience

CVE-2022-34746

Medium

Published: 20 September 2022

Published
20 September 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0029 52.4th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-34746 is a medium-severity Insufficient Entropy (CWE-331) vulnerability in Zyxel Gs1900-8 Firmware. Its CVSS base score is 5.9 (Medium).

Operationally, ranked in the top 47.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve…

more

a private key by factoring the RSA modulus N in the certificate of the web administration interface.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

zyxel
gs1900-8 firmware
≤ 2.70\(aahh.3\)c0
zyxel
gs1900-8hp firmware
≤ 2.70\(aahi.3\)c0
zyxel
gs1900-10hp firmware
≤ 2.70\(aazi.3\)c0
zyxel
gs1900-16 firmware
≤ 2.70\(aahj.3\)c0
zyxel
gs1900-24 firmware
≤ 2.70\(aahl.3\)c0
zyxel
gs1900-24e firmware
≤ 2.70\(aahk.3\)c0
zyxel
gs1900-24ep firmware
≤ 2.70\(abto.3\)c0
zyxel
gs1900-24hpv2 firmware
≤ 2.70\(abtp.3\)c0
zyxel
gs1900-48 firmware
≤ 2.70\(aahn.3\)c0
zyxel
gs1900-48hpv2 firmware
≤ 2.70\(abtq.3\)c0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-331

Approved key-establishment methods mandate sufficient entropy during key generation, eliminating entropy-starved keys.

References