PT-2023-2585 · Zyxel · Zyxel Nbg-418N

Toni Koivunen · Published 2023-01-10 · Updated 2023-05-06 · CVE-2023-22924

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NBG-418N v2 versions prior to V1.00(AARP.14)C0

Description A buffer overflow vulnerability could allow a remote authenticated attacker with administrator privileges to cause denial-of-service (DoS) conditions by executing crafted CLI commands on a vulnerable device. The vulnerability is related to the lack of input size validation, which can be exploited by a remote attacker to disrupt the service.

Recommendations For Zyxel NBG-418N v2 versions prior to V1.00(AARP.14)C0, update the firmware to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the CLI interface to minimize the risk of exploitation. Avoid executing crafted CLI commands on the vulnerable device until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2023-02401

CVE-2023-22924

Affected Products

Zyxel Nbg-418N

References · 9

• https://osv.dev/vulnerability/CVE-2023-22924 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02401 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22924 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router · Vendor Advisory
• https://t.me/cvenotify/49559 · Telegram Post
• https://t.me/cibsecurity/63137 · Telegram Post
• https://vuldb.com/?id.227802 · Note
• https://cybersecurity-help.cz/vdb/SB2023050206 · Note
• https://t.me/cvenotify/49524 · Telegram Post