Deviceways

Router

ZyXEL NBG-419N

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
v1 · Ralink RT3052 Wi-Fi
Retired support documentedFlash: 4 MB · Memory: 32 MBOpen device guide
v2 · Ralink RT3352 Wi-Fi
Flash: 8 MB · Memory: 64 MBGet OpenWrt firmware Release listed · 25.12.6
v2
Get firmware Release listed · 25.12.5
v1; v1 · Ralink RT3052
Open hardware record
v2; v2 · Ralink RT3352
Open hardware record Release listed · 25.12.5
Original project github.com

v1 · Ralink RT3052 Wi-Fi

Device support in source
Retired; check the documented hardware and older release resources.
First installation
U-Boot TFTP + serial recovery

v2 · Ralink RT3352 Wi-Fi

First installation
RedBoot TFTP + serial recovery
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

zyxel nbg-419n v1 — device documentation (github.com)ZyXEL NBG-419N v1 — TechInfoDepot (github.com)ZyXEL NBG-419N v1 — WikiDevi (github.com)

Hardware revision
v1

Device details

zyxel nbg-419n v2 — device documentation (github.com)ZyXEL NBG-419N v2 — TechInfoDepot (github.com)ZyXEL NBG-419N v2 — WikiDevi (github.com)

Hardware revision
v2

Device details

Device details — Source documentation (openwrt.org)

Hardware revision
v1

OpenWrt · v1 · Ralink RT3052 Wi-Fi

OpenWrt · v1 · Ralink RT3052 Wi-Fi — Source documentation (openwrt.org)

Installation routes recorded
U-Boot TFTP + serial recovery
Recovery routes recorded
U-Boot TFTP + serial recovery
Availability recorded by source
Discontinued

Device details

Device details — v2 — Source documentation (openwrt.org)

Hardware revision
v2

OpenWrt · v2 · Ralink RT3352 Wi-Fi

OpenWrt · v2 · Ralink RT3352 Wi-Fi — v2 — Source documentation (openwrt.org)

Installation routes recorded
RedBoot TFTP + serial recovery
Recovery routes recorded
U-Boot TFTP + serial recovery
Availability recorded by source
Discontinued

Hardware differences

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

ZyXEL NBG-419N

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather,…

CVE-2014-0356

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read certcc CVE record
Details and sources
Public disclosure CVE updated

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metacharacters in input to the (1) detectWeather, (2) set_language, (3) SystemCommand, or (4) NTPSyncWithHost function in management.c, or a (5) SET COUNTRY, (6) SET WLAN SSID, (7) SET WLAN CHANNEL, (8) SET WLAN STATUS, or (9) SET WLAN COUNTRY udps command.

CVE published

ZyXEL NBG-419N

Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a…

CVE-2014-0355

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read certcc CVE record
Details and sources
Public disclosure CVE updated

Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle attackers to execute arbitrary code via (1) a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather function; the (2) WeatherCity or (3) WeatherDegree variable to the detectWeather function; unspecified input to the (4) UpnpAddRunRLQoS, (5) UpnpDeleteRunRLQoS, or (6) UpnpDeletePortCheckType function; or (7) the SET COUNTRY udps command.

CVE published

ZyXEL NBG-419N

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain…

CVE-2014-0354

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read certcc CVE record
Details and sources
Public disclosure CVE updated

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request.

CVE published

ZyXEL NBG-419N

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters.

CVE-2014-0353

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read certcc CVE record
Details and sources
Public disclosure CVE updated

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F sequences in place of / (slash) characters.

Check more security advisories for this device · CVE.org