PT-2022-3646 · Zyxel · Zyxel Wac500+9

Marco Ivaldi · Published 2022-05-24 · Updated 2022-06-19 · CVE-2022-26532

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71 Zyxel USG FLEX series firmware versions 4.50 through 5.21 Zyxel ATP series firmware versions 4.32 through 5.21 Zyxel VPN series firmware versions 4.30 through 5.21 Zyxel NSG series firmware versions 1.00 through 1.33 Patch 4 Zyxel NXC2500 firmware version 6.10(AAIG.3) and earlier versions Zyxel NAP203 firmware version 6.25(ABFA.7) and earlier versions Zyxel NWA50AX firmware version 6.25(ABYW.5) and earlier versions Zyxel WAC500 firmware version 6.30(ABVS.2) and earlier versions Zyxel WAX510D firmware version 6.30(ABTF.2) and earlier versions

Description A local authenticated attacker could execute arbitrary OS commands by including crafted arguments to the 'packet-trace' CLI command due to an argument injection vulnerability. This vulnerability is related to the lack of measures to neutralize special elements used in the OS command.

Recommendations For Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, update to a version outside of this range to mitigate the risk. For Zyxel USG FLEX series firmware versions 4.50 through 5.21, update to a version outside of this range to mitigate the risk. For Zyxel ATP series firmware versions 4.32 through 5.21, update to a version outside of this range to mitigate the risk. For Zyxel VPN series firmware versions 4.30 through 5.21, update to a version outside of this range to mitigate the risk. For Zyxel NSG series firmware versions 1.00 through 1.33 Patch 4, update to a version outside of this range to mitigate the risk. For Zyxel NXC2500 firmware version 6.10(AAIG.3) and earlier versions, update to a version later than 6.10(AAIG.3) to mitigate the risk. For Zyxel NAP203 firmware version 6.25(ABFA.7) and earlier versions, update to a version later than 6.25(ABFA.7) to mitigate the risk. For Zyxel NWA50AX firmware version 6.25(ABYW.5) and earlier versions, update to a version later than 6.25(ABYW.5) to mitigate the risk. For Zyxel WAC500 firmware version 6.30(ABVS.2) and earlier versions, update to a version later than 6.30(ABVS.2) to mitigate the risk. For Zyxel WAX510D firmware version 6.30(ABTF.2) and earlier versions, update to a version later than 6.30(ABTF.2) to mitigate the risk. As a temporary workaround, consider disabling the 'packet-trace' CLI command until a patch is available.

Fix

Argument Injection

OS Command Injection

Weakness Enumeration

CWE-88

CWE-78

Related Identifiers

BDU:2022-04431

CVE-2022-26532

Affected Products

Zyxel Atp Series

Zyxel Nap203

Zyxel Nsg Series

Zyxel Nwa50Ax

Zyxel Nxc2500

Zyxel Usg Flex Series

Zyxel Usg/Zywall Series

Zyxel Vpn Series

Zyxel Wac500

Zyxel Wax510D

References · 12

• https://osv.dev/vulnerability/CVE-2022-26532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26532 · Security Note
• https://zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04431 · Security Note
• https://t.me/cvenotify/31464 · Telegram Post
• https://t.me/cvenotify/30619 · Telegram Post
• https://channel4it.com/editorials/zyxel-predupredila-o-mnozhestvennyh-uyazvimostyah-v-svoih-produktah.html · Note
• https://t.me/cibsecurity/43233 · Telegram Post
• https://securitylab.ru/news/531919.php · Note
• http://seclists.org/fulldisclosure/2022/Jun/15 · Note
• http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html · Note
• https://t.me/cvenotify/31876 · Telegram Post