PT-2023-1915 · Zyxel · Zyxel Lte3202-M437+1

Geoffroy Martin + 1 · Publicado 2023-02-21 · Atualizado 2023-03-02 · CVE-2023-22920

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel LTE3316-M604 version V2.00(ABMP.6)C0 Zyxel LTE3202-M437 (affected versions not specified)

Description A security misconfiguration vulnerability exists due to a factory default misconfiguration intended for testing purposes. This allows a remote attacker to access an affected device using Telnet, potentially leading to privilege escalation.

Recommendations For Zyxel LTE3316-M604 version V2.00(ABMP.6)C0, consider disabling Telnet access until a patch is available. For Zyxel LTE3202-M437, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2023-01524

CVE-2023-22920

Produtos afetados

Zyxel Lte3202-M437

Zyxel Lte3316-M604

Referências · 6

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-security-misconfiguration-vulnerability-of-4g-lte-indoor-routers · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01524 · Nota de Segurança
• https://t.me/pentestingnews/33406 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22920 · Aviso do Fabricante
• https://t.me/cibsecurity/58606 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22920 · Nota de Segurança