PT-2023-2586 · Zyxel · Zyxel Nbg-418N

Toni Koivunen · Published 2023-01-10 · Updated 2023-05-06 · CVE-2023-22923

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0

Description A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware could allow a remote authenticated attacker to cause denial-of-service (DoS) conditions on an affected device. The vulnerability is related to the use of uncontrolled format strings when processing binary files. Exploitation of the vulnerability may allow an attacker to cause a denial-of-service by sending specially crafted packets.

Recommendations For Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2023-02402

CVE-2023-22923

Affected Products

Zyxel Nbg-418N

References · 9

• https://osv.dev/vulnerability/CVE-2023-22923 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02402 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22923 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router · Vendor Advisory
• https://vuldb.com/ru/?id.227801 · Note
• https://t.me/cvenotify/49560 · Telegram Post
• https://t.me/cvenotify/49525 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023050206 · Note
• https://t.me/cibsecurity/63125 · Telegram Post