PT-2023-1318 · Zyxel · Zyxel Ax7501-B0

Pshemo · Published 2023-01-17 · Updated 2024-12-06 · CVE-2022-45439

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel AX7501-B0 versions prior to V5.17(ABPC.3)C0

Description The issue is related to the storage of a pair of spare WiFi credentials in the configuration file of the Zyxel AX7501-B0 firmware in cleartext. An unauthenticated attacker could use these credentials to access the WLAN service if the configuration file has been retrieved from the device by leveraging another known vulnerability. This could allow a remote attacker to disclose protected information.

Recommendations For versions prior to V5.17(ABPC.3)C0, update to version V5.17(ABPC.3)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration file to minimize the risk of exploitation. Avoid using the spare WiFi credentials in the configuration file until the issue is resolved.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BDU:2023-00606

CVE-2022-45439

Affected Products

Zyxel Ax7501-B0

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-45439 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-cleartext-storage-of-wifi-credentials-and-improper-symbolic-links-of-ftp-for-ax7501-b0-cpe · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45439 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00606 · Security Note
• https://t.me/cvenotify/42121 · Telegram Post
• https://t.me/cvenotify/103268 · Telegram Post