CVE-2022-43389

Published: Jan 11, 2023Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device.

Affected (17)

Products: Zyxel: Lte3202 M437 Firmware, Lte3316 M604 Firmware, Lte7480 M804 Firmware, Lte7490 M904 Firmware, Nebula Fwa510 Firmware, Nebula Fwa710 Firmware, Nebula Nr7101 Firmware, Nr5103 Firmware, Nr5103e Firmware, Nr7101 Firmware, Nr7102 Firmware, Nr7103 Firmware, Ep240p Firmware, Pm7320 B0 Firmware, Pmg5317 T20b Firmware, Pmg5617ga Firmware, Pmg5622ga Firmware

Zyxel

17 products

Lte3202 M437 Firmware

Lte3316 M604 Firmware

Lte7480 M804 Firmware

Lte7490 M904 Firmware

Nebula Fwa510 Firmware

Nebula Fwa710 Firmware

Nebula Nr7101 Firmware

Pmg5317 T20b Firmware

Pmg5617ga Firmware

Pmg5622ga Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Lte3202 M437 Firmware	Before 1.00\(abwf.1\)c0

Running on/with	Platform Versions
Zyxel Lte3202 M437	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Lte3316 M604 Firmware	Before 2.00\(abmp.6\)c0

Running on/with	Platform Versions
Zyxel Lte3316 M604	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Lte7480 M804 Firmware	Before 1.00\(abra.6\)c0

Running on/with	Platform Versions
Zyxel Lte7480 M804	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Lte7490 M904 Firmware	Before 1.00\(abqy.5\)c0

Running on/with	Platform Versions
Zyxel Lte7490 M904	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Fwa510 Firmware	Before 1.15\(acgd.3\)c0

Running on/with	Platform Versions
Zyxel Nebula Fwa510	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Fwa710 Firmware	Before 1.15\(acgc.3\)c0

Running on/with	Platform Versions
Zyxel Nebula Fwa710	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Nr7101 Firmware	Before 1.15\(accc.3\)c0

Running on/with	Platform Versions
Zyxel Nebula Nr7101	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr5103 Firmware	Before 4.19\(abyc.3\)c0

Running on/with	Platform Versions
Zyxel Nr5103	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr5103e Firmware	All versions

Running on/with	Platform Versions
Zyxel Nr5103e	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr7101 Firmware	Before 1.00\(abuv.7\)c0

Running on/with	Platform Versions
Zyxel Nr7101	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr7102 Firmware	Before 1.00\(abyd.2\)c0

Running on/with	Platform Versions
Zyxel Nr7102	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr7103 Firmware	Before 1.00\(accz.1\)c0

Running on/with	Platform Versions
Zyxel Nr7103	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ep240p Firmware	All versions

Running on/with	Platform Versions
Zyxel Ep240p	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm7320 B0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Pm7320 B0	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pmg5317 T20b Firmware	All versions

Running on/with	Platform Versions
Zyxel Pmg5317 T20b	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pmg5617ga Firmware	All versions

Running on/with	Platform Versions
Zyxel Pmg5617ga	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pmg5622ga Firmware	All versions

Running on/with	Platform Versions
Zyxel Pmg5622ga	All versions

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (2)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

Source: security@zyxel.com.tw

Vendor Advisory

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.