PT-2021-11593 · Zyxel · Zyxel Lte4506-M606

Published 2021-03-16 · Updated 2025-11-07 · CVE-2020-28899

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ZyXEL LTE4506-M606 version V1.00(ABDO.2)C0

Description: The Web CGI Script on the device does not require authentication, allowing remote unauthenticated attackers to use all features provided by the router. This can be achieved by sending crafted JSON action data to the "/cgi-bin/gui.cgi" API endpoint. Examples of possible actions include changing the router password, retrieving the Wi-Fi passphrase, sending an SMS message, or modifying the IP forwarding to access the internal network.

Recommendations: For ZyXEL LTE4506-M606 version V1.00(ABDO.2)C0, consider restricting access to the "/cgi-bin/gui.cgi" API endpoint until a patch is available. As a temporary workaround, limit the use of features that can be exploited by this issue, such as changing the router password or modifying IP forwarding settings.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-28899

Affected Products

Zyxel Lte4506-M606

References · 5

• https://osv.dev/vulnerability/CVE-2020-28899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28899 · Security Note
• https://zyxel.com/support/Zyxel-security-advisory-for-CGI-vulnerability-of-LTE.shtml · Vendor Advisory
• https://twitter.com/HackerMigh32064/status/1986917750028300580 · Twitter Post
• https://t.me/cibsecurity/24965 · Telegram Post