PT-2023-1915 · Zyxel · Zyxel Lte3202-M437+1

Geoffroy Martin + 1 · Published 2023-02-21 · Updated 2023-03-02 · CVE-2023-22920

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel LTE3316-M604 version V2.00(ABMP.6)C0 Zyxel LTE3202-M437 (affected versions not specified)

Description A security misconfiguration vulnerability exists due to a factory default misconfiguration intended for testing purposes. This allows a remote attacker to access an affected device using Telnet, potentially leading to privilege escalation.

Recommendations For Zyxel LTE3316-M604 version V2.00(ABMP.6)C0, consider disabling Telnet access until a patch is available. For Zyxel LTE3202-M437, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-01524

CVE-2023-22920

Affected Products

Zyxel Lte3202-M437

Zyxel Lte3316-M604

References · 6

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-security-misconfiguration-vulnerability-of-4g-lte-indoor-routers · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01524 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22920 · Security Note
• https://t.me/pentestingnews/33406 · Telegram Post
• https://t.me/cibsecurity/58606 · Telegram Post