PT-2023-4362 · Zyxel · Zyxel Nbg6604

Jincheng Wang · Publicado 2023-08-14 · Atualizado 2023-08-22 · CVE-2023-33013

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NBG6604 firmware version V1.01(ABIR.1)C0

Description A post-authentication command injection vulnerability in the NTP feature could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.

Recommendations For Zyxel NBG6604 firmware version V1.01(ABIR.1)C0, consider disabling the NTP feature until a patch is available to prevent potential command injection attacks. Restrict access to the NTP module to minimize the risk of exploitation. Avoid using the NTP feature in the affected firmware version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-04707

CVE-2023-33013

Produtos afetados

Zyxel Nbg6604

Referências · 9

• https://twitter.com/TechFishNews/status/1691156802145275904 · Publicação no Twitter
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-in-ntp-feature-of-nbg6604-home-router · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1691159584369414144 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1691125684242948098 · Publicação no Twitter
• https://t.me/cibsecurity/68454 · Publicação no Telegram
• https://twitter.com/cracbot/status/1691328940735098880 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-33013 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04707 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-33013 · Nota de Segurança