ZLAN Information Technology Co. ZLAN5143D Missing Authentication Vulnerability Allowing Password Reset

A vulnerability exists in the ZLAN Information Technology Co. ZLAN5143D device, specifically in version 1.600. An unprotected API endpoint allows attackers to remotely change the device password without authentication. This vulnerability bypasses authentication mechanisms, potentially leading to unauthorized access or control over the device.

Impact

Exploitation of this vulnerability allows for authentication bypass and unauthorized password changes, which could lead to unauthorized access or control over the affected device.

Remediation

ZLAN Information Technology Co. did not respond to CISA's attempts at coordination. Users of ZLAN5143D devices are encouraged to contact ZLAN and keep their systems up to date.