CVE-2021-35034
📋 TL;DR
This vulnerability allows remote attackers to maintain unauthorized access to Zyxel NBG6604 routers by exploiting insufficient session expiration in the CGI program. Attackers can intercept valid authentication tokens and reuse them to bypass login protections. This affects all users of vulnerable Zyxel NBG6604 router firmware versions.
💻 Affected Systems
- Zyxel NBG6604 Home Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains persistent administrative access to router, enabling network traffic interception, device reconfiguration, malware deployment, and lateral movement into connected networks.
Likely Case
Attacker with network access intercepts session tokens and gains unauthorized administrative access to router management interface.
If Mitigated
With proper network segmentation and access controls, impact limited to isolated router management interface without access to internal network resources.
🎯 Exploit Status
Exploitation requires intercepting valid authentication tokens, which typically requires man-in-the-middle position or access to network traffic. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.00(ABIR.1)C0
Vendor Advisory: https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Maintenance > Firmware Upgrade. 3. Download firmware V1.00(ABIR.1)C0 from Zyxel support site. 4. Upload and apply firmware update. 5. Router will automatically restart after update.
🔧 Temporary Workarounds
Disable Remote Management
allPrevents external attackers from accessing router management interface
Log into router > Network > WAN > Remote Management > Disable
Use HTTPS Only
allEncrypts web interface traffic to prevent token interception
Log into router > Management > Access Control > Enable HTTPS only
🧯 If You Can't Patch
- Isolate router management interface to trusted internal network only
- Implement network segmentation to limit router access to authorized administrators
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: Login > Maintenance > Firmware Information. If version is earlier than V1.00(ABIR.1)C0, device is vulnerable.Check Version:
curl -k https://router-ip/ or check web interface at Maintenance > Firmware InformationVerify Fix Applied:
After patching, verify firmware version shows V1.00(ABIR.1)C0 or later in Maintenance > Firmware Information.📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins from same IP with different user agents
- Session tokens being used from unexpected IP addresses
- Administrative access outside normal business hours
Network Indicators:
- HTTP traffic to router management interface containing session tokens
- Unusual administrative traffic patterns
SIEM Query:
source="router-logs" AND (event="admin_login" AND (src_ip NOT IN allowed_admin_ips OR user_agent_changes > 3))