PT-2023-1577 · Zyxel · Zyxel Nbg-418N

Mariusz Dalewski · Published 2023-02-06 · Updated 2024-12-06 · CVE-2022-45441

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0

Description A cross-site scripting (XSS) vulnerability exists in the Zyxel NBG-418N v2 firmware, which could allow an attacker to store malicious scripts in the Logs page of the GUI on a vulnerable device. A successful XSS attack could force an authenticated user to execute the stored malicious scripts and then result in a denial-of-service (DoS) condition when the user visits the Logs page of the GUI on the device.

Recommendations For Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, update to a version that includes the fix for this issue, specifically V1.00(AARP.13)C0 or later. As a temporary workaround, consider restricting access to the Logs page of the GUI to minimize the risk of exploitation. Avoid using the Logs page until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-01065

CVE-2022-45441

Affected Products

Zyxel Nbg-418N

References · 6

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-nbg-418n-v2-home-router · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45441 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45441 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01065 · Security Note
• https://t.me/cvenotify/103269 · Telegram Post
• https://t.me/cibsecurity/57645 · Telegram Post