CVE-2022-43390

Published: Jan 11, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.

Affected (39)

Products: Zyxel: Lte7480 M804 Firmware, Lte7490 M904 Firmware, Nebula Nr5101 Firmware, Nebula Nr7101 Firmware, Nr5101 Firmware, Nr7101 Firmware, Nr7102 Firmware, Dx3301 T0 Firmware, Dx4510 B1 Firmware, Dx5401 B0 Firmware, Emg3525 T50b Firmware, Emg5523 T50b Firmware, Emg5723 T50k Firmware, Ex3301 T0 Firmware, Ex3510 B0 Firmware, Ex5401 B0 Firmware, Ex5501 B0 Firmware, Ex5510 B0 Firmware, Ex5512 T0 Firmware, Ex5600 T1 Firmware, Ex5601 T0 Firmware, Ex5601 T1 Firmware, Vmg3927 T50k Firmware, Vmg4005 B50a Firmware, Vmg4005 B60a Firmware, Vmg8623 T50b Firmware, Vmg8825 T50k Firmware, Ax7501 B0 Firmware, Pm3100 T0 Firmware, Pm5100 T0 Firmware, Pm7300 T0 Firmware, Pm7320 B0 Firmware, Pmg5317 T20b Firmware, Pmg5617 T20b2 Firmware, Pmg5617ga Firmware, Pmg5622ga Firmware, Wx3100 T0 Firmware, Wx3401 B0 Firmware, Wx5600 T0 Firmware

Zyxel

39 products

Lte7480 M804 Firmware

Lte7490 M904 Firmware

Nebula Nr5101 Firmware

Nebula Nr7101 Firmware

Emg3525 T50b Firmware

Emg5523 T50b Firmware

Emg5723 T50k Firmware

Vmg3927 T50k Firmware

Vmg4005 B50a Firmware

Vmg4005 B60a Firmware

Vmg8623 T50b Firmware

Vmg8825 T50k Firmware

Pmg5317 T20b Firmware

Pmg5617 T20b2 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Lte7480 M804 Firmware	Before 1.00\(abra.6\)c0

Running on/with	Platform Versions
Zyxel Lte7480 M804	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Lte7490 M904 Firmware	Before 1.00\(abqy.5\)c0

Running on/with	Platform Versions
Zyxel Lte7490 M904	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Nr5101 Firmware	Before 1.15\(accg.3\)c0

Running on/with	Platform Versions
Zyxel Nebula Nr5101	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nebula Nr7101 Firmware	Before 1.15\(accc.3\)c0

Running on/with	Platform Versions
Zyxel Nebula Nr7101	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr5101 Firmware	Before 1.00\(abvc.6\)c0

Running on/with	Platform Versions
Zyxel Nr5101	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr7101 Firmware	Before 1.00\(abuv.7\)c0

Running on/with	Platform Versions
Zyxel Nr7101	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nr7102 Firmware	Before 1.00\(abyd.2\)c0

Running on/with	Platform Versions
Zyxel Nr7102	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx3301 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Dx3301 T0	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx4510 B1 Firmware	All versions

Running on/with	Platform Versions
Zyxel Dx4510 B1	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Dx5401 B0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Dx5401 B0	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Emg3525 T50b Firmware	All versions

Running on/with	Platform Versions
Zyxel Emg3525 T50b	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Emg5523 T50b Firmware	All versions

Running on/with	Platform Versions
Zyxel Emg5523 T50b	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Emg5723 T50k Firmware	All versions

Running on/with	Platform Versions
Zyxel Emg5723 T50k	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3301 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Ex3301 T0	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex3510 B0 Firmware	Before 5.17\(abup.7\)c0

Running on/with	Platform Versions
Zyxel Ex3510 B0	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5401 B0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Ex5401 B0	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5501 B0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Ex5501 B0	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5510 B0 Firmware	Before 5.17\(abqx.7\)c0

Running on/with	Platform Versions
Zyxel Ex5510 B0	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5512 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Ex5512 T0	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5600 T1 Firmware	All versions

Running on/with	Platform Versions
Zyxel Ex5600 T1	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5601 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Ex5601 T0	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ex5601 T1 Firmware	All versions

Running on/with	Platform Versions
Zyxel Ex5601 T1	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg3927 T50k Firmware	All versions

Running on/with	Platform Versions
Zyxel Vmg3927 T50k	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg4005 B50a Firmware	All versions

Running on/with	Platform Versions
Zyxel Vmg4005 B50a	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg4005 B60a Firmware	All versions

Running on/with	Platform Versions
Zyxel Vmg4005 B60a	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg8623 T50b Firmware	All versions

Running on/with	Platform Versions
Zyxel Vmg8623 T50b	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vmg8825 T50k Firmware	All versions

Running on/with	Platform Versions
Zyxel Vmg8825 T50k	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Ax7501 B0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Ax7501 B0	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm3100 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Pm3100 T0	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm5100 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Pm5100 T0	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm7300 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Pm7300 T0	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pm7320 B0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Pm7320 B0	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pmg5317 T20b Firmware	All versions

Running on/with	Platform Versions
Zyxel Pmg5317 T20b	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pmg5617 T20b2 Firmware	All versions

Running on/with	Platform Versions
Zyxel Pmg5617 T20b2	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pmg5617ga Firmware	All versions

Running on/with	Platform Versions
Zyxel Pmg5617ga	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Pmg5622ga Firmware	All versions

Running on/with	Platform Versions
Zyxel Pmg5622ga	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wx3100 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Wx3100 T0	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wx3401 B0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Wx3401 B0	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wx5600 T0 Firmware	All versions

Running on/with	Platform Versions
Zyxel Wx5600 T0	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

Source: security@zyxel.com.tw

Vendor Advisory

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.