PT-2023-1414 · Zyxel · Zyxel Gs1920-24V2+4

Nikita Abramov · Published 2023-01-11 · Updated 2023-01-26 · CVE-2022-43393

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Zyxel GS1920-24v2 firmware versions prior to V4.70(ABMH.8)C0 Zyxel GS1350, GS1915, GS1920, GS2220 (affected versions not specified)

Description The issue is related to an improper check for unusual or exceptional conditions in the HTTP request processing function, which could allow an unauthenticated attacker to corrupt the contents of the memory and result in a denial-of-service (DoS) condition on a vulnerable device.

Recommendations For Zyxel GS1920-24v2 firmware versions prior to V4.70(ABMH.8)C0, update to V4.70(ABMH.8)C0 or later to resolve the issue. For Zyxel GS1350, GS1915, GS1920, GS2220, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2023-00796

CVE-2022-43393

Affected Products

Zyxel Gs1350

Zyxel Gs1915

Zyxel Gs1920

Zyxel Gs1920-24V2

Zyxel Gs2220

References · 6

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-switches · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43393 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43393 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00796 · Security Note
• https://t.me/cibsecurity/56325 · Telegram Post
• https://t.me/hnews/37212 · Telegram Post