PT-2023-1318 · Zyxel · Zyxel Ax7501-B0

Pshemo · Publicado 2023-01-17 · Atualizado 2024-12-06 · CVE-2022-45439

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel AX7501-B0 versions prior to V5.17(ABPC.3)C0

Description The issue is related to the storage of a pair of spare WiFi credentials in the configuration file of the Zyxel AX7501-B0 firmware in cleartext. An unauthenticated attacker could use these credentials to access the WLAN service if the configuration file has been retrieved from the device by leveraging another known vulnerability. This could allow a remote attacker to disclose protected information.

Recommendations For versions prior to V5.17(ABPC.3)C0, update to version V5.17(ABPC.3)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration file to minimize the risk of exploitation. Avoid using the spare WiFi credentials in the configuration file until the issue is resolved.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

BDU:2023-00606

CVE-2022-45439

Produtos afetados

Zyxel Ax7501-B0

Referências · 6

• https://t.me/cvenotify/42121 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45439 · Nota de Segurança
• https://t.me/cvenotify/103268 · Publicação no Telegram
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-cleartext-storage-of-wifi-credentials-and-improper-symbolic-links-of-ftp-for-ax7501-b0-cpe · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-45439 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-00606 · Nota de Segurança