PT-2022-7090 · Zyxel · Zyxel Nbg7510

Alexander Traud · Published 2022-12-20 · Updated 2022-12-29 · CVE-2022-38546

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel NBG7510 versions prior to V1.00(ABZY.3)C0

Description The issue is related to a DNS misconfiguration in the Zyxel NBG7510 firmware, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode. This is due to insufficient access control.

Recommendations For versions prior to V1.00(ABZY.3)C0, update the firmware to V1.00(ABZY.3)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the AP mode until the update is applied.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-07565

CVE-2022-38546

Affected Products

Zyxel Nbg7510

References · 6

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dns-misconfiguration-in-nbg7510-home-router · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07565 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38546 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38546 · Vendor Advisory
• https://t.me/cibsecurity/55039 · Telegram Post
• https://t.me/cvenotify/40958 · Telegram Post