PT-2023-2563 · Zyxel · Zyxel Nbg-418N

Toni Koivunen · Published 2023-01-10 · Updated 2023-05-06 · CVE-2023-22921

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0

Description A cross-site scripting (XSS) issue is present in the web management interface, related to insufficient protection of the web page structure when handling parameters. This could allow a remote attacker with administrator privileges to store malicious scripts, resulting in denial-of-service (DoS) conditions on an affected device.

Recommendations For Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0, update to version V1.00(AARP.14)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the web management interface to minimize the risk of exploitation. Avoid using vulnerable parameters in the web management interface until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-02378

CVE-2023-22921

Affected Products

Zyxel Nbg-418N

References · 10

• https://bdu.fstec.ru/vul/2023-02378 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22921 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22921 · Vendor Advisory
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router · Vendor Advisory
• https://t.me/cvenotify/49527 · Telegram Post
• https://t.me/cvenotify/49562 · Telegram Post
• https://t.me/cibsecurity/63133 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023050206 · Note
• https://vuldb.com/?id.227811 · Note
• https://t.me/cvenotify/49794 · Telegram Post