CVE-2022-43392 | ByteOS Network

Vulnerability Details :

CVE-2022-43392

Assigner-Zyxel

Assigner Org ID-96e50032-ad0d-4058-a115-4d2c13821f9f

Published At-11 Jan, 2023 | 00:00

Updated At-27 Nov, 2024 | 17:13

A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to cause denial-of-service (DoS) conditions by sending a crafted authorization request.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:Zyxel

Assigner Org ID:96e50032-ad0d-4058-a115-4d2c13821f9f

Published At:11 Jan, 2023 | 00:00

Updated At:27 Nov, 2024 | 17:13

▼CVE Numbering Authority (CNA)

A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to cause denial-of-service (DoS) conditions by sending a crafted authorization request.

Affected Products

Vendor

Zyxel Networks Corporation

Product

NR7101 firmware

Default Status

unaffected

Versions

Affected

< V1.15(ACCC.3)C0

Problem Types

Type	CWE ID	Description
CWE	CWE-120	CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Type: CWE

CWE ID: CWE-120

Description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Hyperlink	Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders	N/A

Hyperlink: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders	x_transferred

Hyperlink: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security@zyxel.com.tw

Published At:11 Jan, 2023 | 02:15

Updated At:29 Dec, 2023 | 07:15

A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to cause denial-of-service (DoS) conditions by sending a crafted authorization request.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CPE Matches

Zyxel Networks Corporation

>>lte3301-plus_firmware>>-

cpe:2.3:o:zyxel:lte3301-plus_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte3301-plus>>-

cpe:2.3:h:zyxel:lte3301-plus:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte5388-m804_firmware>>-

cpe:2.3:o:zyxel:lte5388-m804_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte5388-m804>>-

cpe:2.3:h:zyxel:lte5388-m804:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte5398-m904_firmware>>-

cpe:2.3:o:zyxel:lte5398-m904_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte5398-m904>>-

cpe:2.3:h:zyxel:lte5398-m904:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7240-m403_firmware>>-

cpe:2.3:o:zyxel:lte7240-m403_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7240-m403>>-

cpe:2.3:h:zyxel:lte7240-m403:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7461-m602_firmware>>-

cpe:2.3:o:zyxel:lte7461-m602_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7461-m602>>-

cpe:2.3:h:zyxel:lte7461-m602:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7480-m804_firmware>>Versions before 1.00\(abra.6\)c0(exclusive)

cpe:2.3:o:zyxel:lte7480-m804_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7480-m804>>-

cpe:2.3:h:zyxel:lte7480-m804:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7480-s905_firmware>>-

cpe:2.3:o:zyxel:lte7480-s905_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7480-s905>>-

cpe:2.3:h:zyxel:lte7480-s905:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7485-s905_firmware>>-

cpe:2.3:o:zyxel:lte7485-s905_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7485-s905>>-

cpe:2.3:h:zyxel:lte7485-s905:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7490-m904_firmware>>Versions before 1.00\(abqy.5\)c0(exclusive)

cpe:2.3:o:zyxel:lte7490-m904_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>lte7490-m904>>-

cpe:2.3:h:zyxel:lte7490-m904:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nebula_lte3301-plus_firmware>>Versions before 1.15\(acca.3\)c0(exclusive)

cpe:2.3:o:zyxel:nebula_lte3301-plus_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nebula_lte3301-plus>>-

cpe:2.3:h:zyxel:nebula_lte3301-plus:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nebula_lte7461-m602_firmware>>Versions before 1.15\(acev.3\)c0(exclusive)

cpe:2.3:o:zyxel:nebula_lte7461-m602_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nebula_lte7461-m602>>-

cpe:2.3:h:zyxel:nebula_lte7461-m602:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nebula_nr5101_firmware>>Versions before 1.15\(accg.3\)c0(exclusive)

cpe:2.3:o:zyxel:nebula_nr5101_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nebula_nr5101>>-

cpe:2.3:h:zyxel:nebula_nr5101:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nebula_nr7101_firmware>>Versions before 1.15\(accc.3\)c0(exclusive)

cpe:2.3:o:zyxel:nebula_nr7101_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nebula_nr7101>>-

cpe:2.3:h:zyxel:nebula_nr7101:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nr5101_firmware>>Versions before 1.00\(abvc.6\)c0(exclusive)

cpe:2.3:o:zyxel:nr5101_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:nr5101:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nr7101_firmware>>Versions before 1.00\(abuv.7\)c0(exclusive)

cpe:2.3:o:zyxel:nr7101_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:nr7101:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>nr7102_firmware>>Versions before 1.00\(abyd.2\)c0(exclusive)

cpe:2.3:o:zyxel:nr7102_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:nr7102:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>dx3301-t0_firmware>>-

cpe:2.3:o:zyxel:dx3301-t0_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:dx3301-t0:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>dx4510-b1_firmware>>-

cpe:2.3:o:zyxel:dx4510-b1_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:dx4510-b1:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>dx5401-b0_firmware>>-

cpe:2.3:o:zyxel:dx5401-b0_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:dx5401-b0:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>emg3525-t50b_firmware>>-

cpe:2.3:o:zyxel:emg3525-t50b_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>emg3525-t50b>>-

cpe:2.3:h:zyxel:emg3525-t50b:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>emg5523-t50b_firmware>>-

cpe:2.3:o:zyxel:emg5523-t50b_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>emg5523-t50b>>-

cpe:2.3:h:zyxel:emg5523-t50b:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>emg5723-t50k_firmware>>-

cpe:2.3:o:zyxel:emg5723-t50k_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>emg5723-t50k>>-

cpe:2.3:h:zyxel:emg5723-t50k:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>ex3301-t0_firmware>>-

cpe:2.3:o:zyxel:ex3301-t0_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:ex3301-t0:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>ex3510-b0_firmware>>Versions before 5.17\(abup.7\)c0(exclusive)

cpe:2.3:o:zyxel:ex3510-b0_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:ex3510-b0:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>ex5401-b0_firmware>>-

cpe:2.3:o:zyxel:ex5401-b0_firmware:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

cpe:2.3:h:zyxel:ex5401-b0:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-120	Primary	nvd@nist.gov
CWE-120	Secondary	security@zyxel.com.tw

CWE ID: CWE-120

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-120

Type: Secondary

Source: security@zyxel.com.tw

References

Hyperlink	Source	Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders	security@zyxel.com.tw	Vendor Advisory

Hyperlink: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

Source: security@zyxel.com.tw

Resource:

Vendor Advisory