PT-2023-2563 · Zyxel · Zyxel Nbg-418N

Toni Koivunen · Publicado 2023-01-10 · Atualizado 2023-05-06 · CVE-2023-22921

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0

Description A cross-site scripting (XSS) issue is present in the web management interface, related to insufficient protection of the web page structure when handling parameters. This could allow a remote attacker with administrator privileges to store malicious scripts, resulting in denial-of-service (DoS) conditions on an affected device.

Recommendations For Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0, update to version V1.00(AARP.14)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the web management interface to minimize the risk of exploitation. Avoid using vulnerable parameters in the web management interface until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-02378

CVE-2023-22921

Produtos afetados

Zyxel Nbg-418N

Referências · 10

• https://bdu.fstec.ru/vul/2023-02378 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-22921 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22921 · Aviso do Fabricante
• https://t.me/cvenotify/49527 · Publicação no Telegram
• https://t.me/cvenotify/49562 · Publicação no Telegram
• https://t.me/cibsecurity/63133 · Publicação no Telegram
• https://cybersecurity-help.cz/vdb/SB2023050206 · Nota
• https://vuldb.com/?id.227811 · Nota
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router · Aviso do Fabricante
• https://t.me/cvenotify/49794 · Publicação no Telegram