PT-2023-4362 · Zyxel · Zyxel Nbg6604

Jincheng Wang · Published 2023-08-14 · Updated 2023-08-22 · CVE-2023-33013

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NBG6604 firmware version V1.01(ABIR.1)C0

Description A post-authentication command injection vulnerability in the NTP feature could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.

Recommendations For Zyxel NBG6604 firmware version V1.01(ABIR.1)C0, consider disabling the NTP feature until a patch is available to prevent potential command injection attacks. Restrict access to the NTP module to minimize the risk of exploitation. Avoid using the NTP feature in the affected firmware version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-04707

CVE-2023-33013

Affected Products

Zyxel Nbg6604

References · 9

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-in-ntp-feature-of-nbg6604-home-router · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33013 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04707 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-33013 · Security Note
• https://twitter.com/TechFishNews/status/1691156802145275904 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1691159584369414144 · Twitter Post
• https://twitter.com/CVEnew/status/1691125684242948098 · Twitter Post
• https://t.me/cibsecurity/68454 · Telegram Post
• https://twitter.com/cracbot/status/1691328940735098880 · Twitter Post