PT-2023-2520 · Zyxel · Zyxel Dx5401-B0

Published 2023-04-27 · Updated 2024-11-07 · CVE-2023-28769

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZyXEL DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0

Description The issue is related to a buffer overflow vulnerability in the libclinkc.so library of the zhttpd web server. This vulnerability could allow a remote unauthenticated attacker to execute some OS commands or cause denial-of-service (DoS) conditions on a vulnerable device.

Recommendations For ZyXEL DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0, update to version V5.17(ABYO.1)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the zhttpd web server to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2023-02319

CVE-2023-28769

Affected Products

Zyxel Dx5401-B0

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28769 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02319 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28769 · Vendor Advisory
• https://t.me/cvenotify/49171 · Telegram Post
• https://t.me/aptreports/13783 · Telegram Post
• https://twitter.com/rst_cloud/status/1852727229395984796 · Twitter Post
• https://twitter.com/rst_cloud/status/1854517418581701059 · Twitter Post
• https://t.me/cvenotify/49979 · Telegram Post
• https://t.me/aptreports/13882 · Telegram Post
• https://levelblue.com/blogs/labs-research/ngioweb-remains-active-7-years-later · Note