Zyxel Releases Security Update

Zyxel releases security updates addressing vulnerabilities in multiple products

Threat ID:: CC-4260
Threat Severity:: Information only
Published:: 10 February 2023 2:38 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Zyxel releases security updates addressing vulnerabilities in multiple products

Affected platforms

The following platforms are known to be affected:

Zyxel LTE Router

Zyxel Virtual Private Network (VPN) Series

The following platforms are also known to be affected:

Please review Zyxel's security advisories for more information about these and many more affected products.

Threat details

Introduction

Zyxel has released six security advisories to address ten vulnerabilities across multiple products. A remote, unauthenticated attacker could exploit some of these vulnerabilities to perform a denial-of-service (DoS) attack, allow command injection, or perform remote code execution (RCE), to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Zyxel's security advisories and apply relevant updates and mitigations.

Remediation steps

Type	Step
Patch	Zyxel security advisory for command injection and buffer overflow vulnerabilities of CPE fiber ONTS and Wi-Fi extenders https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders
	Zyxel security advisory for DoS vulnerability of switches https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-switches
Patch	Zyxel security advisory for cleartext storage of Wi-Fi credentials and improper symbolic links of FTO for AX7501 B0 CPE https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-cleartext-storage-of-wifi-credentials-and-improper-symbolic-links-of-ftp-for-ax7501-b0-cpe
Patch	Zyxel security advisory for XSS vulnerability in NBG 418N v2 home router https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-nbg-418n-v2-home-router
Patch	Zyxel security advisory for post authentication RCE in firewalls https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-firewalls
Patch	Zyxel security advisory for DoS vulnerability of APS https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-aps

Definitive source of threat updates

https://www.zyxel.com/global/en/support/security-advisories

CVE Vulnerabilities

Status Published

CVE-2022-43392

A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to cause denial-of-service (DoS) conditions by sending a crafted authorization request.

Status Published

CVE-2022-43391

A buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to cause denial-of-service (DoS) conditions by sending a crafted HTTP request.

Status Published

CVE-2022-43390

A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.

Status Published

CVE-2022-43389

A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device.

Status Published

CVE-2022-43393

An improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70(ABMH.8)C0, which could allow an unauthenticated attacker to corrupt the contents of the memory and result in a denial-of-service (DoS) condition on a vulnerable device.

Status Published

CVE-2022-45440

A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system by creating a symbolic link on external storage media, such as a USB flash drive, and then logging into the FTP server on a vulnerable device.

Status Published

CVE-2022-45439

A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. An unauthenticated attacker could use the credentials to access the WLAN service if the configuration file has been retrieved from the device by leveraging another known vulnerability.

Status Published

CVE-2022-45441

A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker to store malicious scripts in the Logs page of the GUI on a vulnerable device. A successful XSS attack could force an authenticated user to execute the stored malicious scripts and then result in a denial-of-service (DoS) condition when the user visits the Logs page of the GUI on the device.

Status Published

CVE-2022-38547

A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.

Status Published

CVE-2022-45854

An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary denial-of-service (DoS) by sending crafted VLAN frames if the MAC address of the vulnerable AP were intercepted by the attacker.

Last edited: 10 February 2023 2:38 pm