CVE-2022-34746

🔶 medium

Summary

An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.

CVSS Score

5.9

Medium

EPSS Score

0.3

Exploit Probability

Published Date

2022-09-20

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 32.1% of all 365,968 vulnerabilities in our database.

#248,481

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 29, 2025

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2024-11-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-331

📦 Affected Products 10

Vendor	Product	Status	Affected Versions
zyxel	gs1900-10hp_firmware	Affected	< 2.70\(aazi.3\)c0
zyxel	gs1900-16_firmware	Affected	< 2.70\(aahj.3\)c0
zyxel	gs1900-24_firmware	Affected	< 2.70\(aahl.3\)c0
zyxel	gs1900-24e_firmware	Affected	< 2.70\(aahk.3\)c0
zyxel	gs1900-48_firmware	Affected	< 2.70\(aahn.3\)c0
zyxel	gs1900-8_firmware	Affected	< 2.70\(aahh.3\)c0
zyxel	gs1900-8hp_firmware	Affected	< 2.70\(aahi.3\)c0
zyxel	gs1900-24ep_firmware	Affected	< 2.70\(abto.3\)c0
zyxel	gs1900-24hpv2_firmware	Affected	< 2.70\(abtp.3\)c0
zyxel	gs1900-48hpv2_firmware	Affected	< 2.70\(abtq.3\)c0

🔗 References 1

https://www.zyxel.com/global/en/support/security-adv...

Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-7273	⚠️ high	8.8	-	A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(AB...	2026-06-16
CVE-2024-8881	🔶 medium	6.8	0.1	A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version ...	2024-11-12
CVE-2024-8882	🔶 medium	4.5	0.1	A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and ea...	2024-11-12
CVE-2024-38270	🔶 medium	5.3	0.2	An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authe...	2024-09-10
CVE-2023-35140	🔶 medium	5.5	0.1	The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could al...	2023-11-07
CVE-2022-45853	🔶 medium	6.7	0.0	The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmwa...	2023-05-30

These CVEs affect the same products