{"vulnerability": "CVE-2021-35036", "sightings": [{"uuid": "ec03d352-7895-4e6a-afca-2e4ae034d5e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "seen", "source": "https://t.me/cibsecurity/38251", "content": "\u203c CVE-2021-35036 \u203c\n\nA command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-01T12:23:58.000000Z"}, {"uuid": "466bd6bc-532c-4190-9694-80a998993198", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-35036", "type": "seen", "source": "https://bsky.app/profile/securitycipher.bsky.social/post/3mmgziloe5e2g", "content": "CVE-2021\u201335036: Super-Admin Password Leak Affecting Zyxel CPE/ONT/LTE Fleet\n\nhttps://medium.com/@monxresearch/cve-2021-35036-super-admin-password-leak-affecting-zyxel-cpe-ont-lte-fleet-6549d72d0f3d?source=rss------bug_bounty-5", "creation_timestamp": "2026-05-22T13:18:25.710222Z"}, {"uuid": "6d5b6126-1bac-428d-9668-f27f13499bb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mmoxcast6o2h", "content": "Zyxel router flaw let unprivileged users pull super-admin passwords and management secrets. New technical breakdown of CVE-2021-35036 shows the access\u2026\n\nhttps://www.reddit.com/r/netsec/comments/1tkkq0m/zyxel_lowpriv_account_leaked_superadmin_ftps_and/\n\n#cybersecurity #infosec", "creation_timestamp": "2026-05-25T17:00:23.338947Z"}, {"uuid": "49ace9cb-cd3b-4f7e-96d2-6a3c670152db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "seen", "source": "https://t.me/hacking_Attack/185879", "content": "On affected Zyxel firmware, a low-privileged account could call backend DAL endpoints and get back supervisor/admin account data, FTPS credentials, and TR-069 secrets. The UI could hide privileged pages, but the backend was still returning sensitive objects to the weaker role. The writeup covers the DAL endpoints, why masking values in the UI was not enough, the affected device expansion, and the patch trail. I also added a separate firmware lab around Zyxel\u2019s password generator. https://minanagehsalalma.github.io/zyxel-cve-2021-35036-super-admin-password-leak/    submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://www.reddit.com/gallery/1tkl31w)   [comments] (https://www.reddit.com/r/Pentesting/comments/1tkl31w/zyxel_lowpriv_router_account_exposed_superadmin/)", "creation_timestamp": "2026-09-01T20:00:10.209198Z"}, {"uuid": "2c8b77e1-0bdf-4c7c-9f4b-7474dee3a87e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "seen", "source": "https://t.me/hacking_Attack/185905", "content": "I did some restyling and cleanup on my Zyxel CVE-2021-35036 writeup and wanted to re-share it here. On affected Zyxel firmware, a low-privileged authenticated account could reach backend DAL/CGI logic that returned sensitive account and management configuration data, including higher-privileged local account information, FTPS-related credentials, and TR-069 secrets. The UI hid or masked some privileged fields, but the backend still returned sensitive objects to a weaker role.     submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://minanagehsalalma.github.io/zyxel-cve-2021-35036-super-admin-password-leak/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1tldvru/zyxel_lowpriv_account_exposed_superadmin_and/)", "creation_timestamp": "2026-09-01T20:00:10.249720Z"}, {"uuid": "e3e7b4d8-22a9-41fa-9e81-1e42591ea126", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "seen", "source": "https://t.me/hacking_Attack/185865", "content": "CVE-2021\u201335036: Super-Admin Password Leak Affecting Zyxel CPE/ONT/LTE Fleet\nhttps://medium.com/@monxresearch/cve-2021-35036-super-admin-password-leak-affecting-zyxel-cpe-ont-lte-fleet-6549d72d0f3d?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-01T20:00:10.454110Z"}, {"uuid": "7b8c1fbe-9c36-40c3-b013-c800a38b344e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "seen", "source": "https://t.me/hacking_Attack/185866", "content": "Executive SummaryContinue reading on Medium \u00bb (https://medium.com/@monxresearch/cve-2021-35036-super-admin-password-leak-affecting-zyxel-cpe-ont-lte-fleet-6549d72d0f3d?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-01T20:00:10.499835Z"}, {"uuid": "7cbeb558-26a9-4108-8d8c-277ac88e5286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/185866", "content": "Executive SummaryContinue reading on Medium \u00bb (https://medium.com/@monxresearch/cve-2021-35036-super-admin-password-leak-affecting-zyxel-cpe-ont-lte-fleet-6549d72d0f3d?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-02T01:00:19.654072Z"}, {"uuid": "6f7b8130-de47-46ce-b45c-18ec91393176", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/185865", "content": "CVE-2021\u201335036: Super-Admin Password Leak Affecting Zyxel CPE/ONT/LTE Fleet\nhttps://medium.com/@monxresearch/cve-2021-35036-super-admin-password-leak-affecting-zyxel-cpe-ont-lte-fleet-6549d72d0f3d?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-02T01:00:19.715160Z"}, {"uuid": "f30e1e45-4a29-4ec2-938e-cd97e90f3441", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/185905", "content": "I did some restyling and cleanup on my Zyxel CVE-2021-35036 writeup and wanted to re-share it here. On affected Zyxel firmware, a low-privileged authenticated account could reach backend DAL/CGI logic that returned sensitive account and management configuration data, including higher-privileged local account information, FTPS-related credentials, and TR-069 secrets. The UI hid or masked some privileged fields, but the backend still returned sensitive objects to a weaker role.     submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://minanagehsalalma.github.io/zyxel-cve-2021-35036-super-admin-password-leak/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1tldvru/zyxel_lowpriv_account_exposed_superadmin_and/)", "creation_timestamp": "2026-09-02T01:00:19.952489Z"}, {"uuid": "08ca2ca8-fdf6-4caa-a331-c2d46f846e30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/185879", "content": "On affected Zyxel firmware, a low-privileged account could call backend DAL endpoints and get back supervisor/admin account data, FTPS credentials, and TR-069 secrets. The UI could hide privileged pages, but the backend was still returning sensitive objects to the weaker role. The writeup covers the DAL endpoints, why masking values in the UI was not enough, the affected device expansion, and the patch trail. I also added a separate firmware lab around Zyxel\u2019s password generator. https://minanagehsalalma.github.io/zyxel-cve-2021-35036-super-admin-password-leak/    submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://www.reddit.com/gallery/1tkl31w)   [comments] (https://www.reddit.com/r/Pentesting/comments/1tkl31w/zyxel_lowpriv_router_account_exposed_superadmin/)", "creation_timestamp": "2026-09-02T01:00:20.006809Z"}]}