PT-2023-1559 · Zyxel · Zyxel Nr7101

Published 2023-01-11 · Updated 2023-01-18 · CVE-2022-43390

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel NR7101 firmware versions prior to V1.15(ACCC.3)C0

Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to execute arbitrary commands using a specially crafted HTTP request. An authenticated attacker could execute some OS commands on a vulnerable device by sending a crafted HTTP request.

Recommendations For Zyxel NR7101 firmware versions prior to V1.15(ACCC.3)C0, update to version V1.15(ACCC.3)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the CGI program to minimize the risk of exploitation. Avoid using the vulnerable CGI program until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-01024

CVE-2022-43390

Affected Products

Zyxel Nr7101

References · 6

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43390 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43390 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01024 · Security Note
• https://t.me/cvenotify/41795 · Telegram Post
• https://t.me/cibsecurity/56330 · Telegram Post