PT-2023-1414 · Zyxel · Zyxel Gs1920-24V2+4

Nikita Abramov · Publicado 2023-01-11 · Atualizado 2023-01-26 · CVE-2022-43393

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Zyxel GS1920-24v2 firmware versions prior to V4.70(ABMH.8)C0 Zyxel GS1350, GS1915, GS1920, GS2220 (affected versions not specified)

Description The issue is related to an improper check for unusual or exceptional conditions in the HTTP request processing function, which could allow an unauthenticated attacker to corrupt the contents of the memory and result in a denial-of-service (DoS) condition on a vulnerable device.

Recommendations For Zyxel GS1920-24v2 firmware versions prior to V4.70(ABMH.8)C0, update to V4.70(ABMH.8)C0 or later to resolve the issue. For Zyxel GS1350, GS1915, GS1920, GS2220, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

Identificadores relacionados

BDU:2023-00796

CVE-2022-43393

Produtos afetados

Zyxel Gs1350

Zyxel Gs1915

Zyxel Gs1920

Zyxel Gs1920-24V2

Zyxel Gs2220

Referências · 6

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-switches · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-43393 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-43393 · Aviso do Fabricante
• https://t.me/cibsecurity/56325 · Publicação no Telegram
• https://t.me/hnews/37212 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-00796 · Nota de Segurança