{"uuid": "2c8b77e1-0bdf-4c7c-9f4b-7474dee3a87e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35036", "type": "seen", "source": "https://t.me/hacking_Attack/185905", "content": "I did some restyling and cleanup on my Zyxel CVE-2021-35036 writeup and wanted to re-share it here. On affected Zyxel firmware, a low-privileged authenticated account could reach backend DAL/CGI logic that returned sensitive account and management configuration data, including higher-privileged local account information, FTPS-related credentials, and TR-069 secrets. The UI hid or masked some privileged fields, but the backend still returned sensitive objects to a weaker role.     submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://minanagehsalalma.github.io/zyxel-cve-2021-35036-super-admin-password-leak/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1tldvru/zyxel_lowpriv_account_exposed_superadmin_and/)", "creation_timestamp": "2026-09-01T20:00:10.249720Z"}