Zyxel security advisory for OS command injection and buffer overflow vulnerabilities of CPE and ONTs

Zyxel_Jason
Zyxel_Jason Posts: 374
25 Answers First Comment Friend Collector Fourth Anniversary
 Master Member
edited April 21 in Security Advisories

CVE: CVE-2022-26413, CVE-2022-26414

Summary

Zyxel is aware of OS command injection and buffer overflow vulnerabilities affecting some CPE and ONT models. Users are advised to adopt the applicable firmware updates for optimal protection.

What is the vulnerability?

CVE-2022-26413

A command injection vulnerability in the CGI program of VMG3312-T20A could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.

CVE-2022-26414

A buffer overflow vulnerability was identified in some internal functions of VMG3312-T20A due to a lack of input validation and boundary verification.

What versions are vulnerable—and what should you do?

After a thorough investigation, we’ve identified the affected products that are within their vulnerability support period, as shown in the table below. We encourage users to install the applicable updates for optimal protection. 

The model mentioned in the CVE description, VMG3312-T20A, entered end-of-life years previously. Therefore, firmware updates are no longer supported. We recommend that users with this model replace it with a newer-generation product, which typically come with improved designs that better suit current applications. 

Note that the table below does NOT include customized models for internet service providers (ISPs). For ISPs, please contact your Zyxel sales or service representatives for further details. For users who purchased the listed devices on their own, please contact your local Zyxel support team for the new firmware file to ensure optimal protection.


Product 

Model

Patch availability*

DSL/Ethernet CPE

EMG3525-T50B

EMEA: V5.50(ABPM.6)C0
America: V5.50(ABSL.0)B12 in Sep. 2022

EMG5523-T50B

EMEA: V5.50(ABPM.6)C0
America: V5.50(ABSL.0)B12 in Sep. 2022

EMG5723-T50K

V5.50(ABOM.7)C0

EMG6726-B10A

V5.13(ABNP.7)C0 in Jun. 2022

VMG1312-T20B

V5.30(ABSB.5)C0

VMG3625-T50B

V5.50(ABPM.6)C0

VMG3927-B50A

V5.17(ABMT.6)C0

VMG3927-B50B

V5.13(ABLY.7)C0 in Jun. 2022

VMG3927-B60A

V5.17(ABMT.6)C0

VMG3927-T50K

V5.50(ABOM.7)C0

VMG4927-B50A

V5.13(ABLY.7)C0 in Jun. 2022

VMG8623-T50B

V5.50(ABPM.6)C0

VMG8825-B50A

V5.17(ABMT.6)C0

VMG8825-B50B

V5.17(ABNY.7)C0

VMG8825-T50K

V5.50(ABOM.7)C0

VMG8825-B60A

V5.17(ABMT.6)C0

VMG8825-B60B

V5.17(ABNY.7)C0

XMG3927-B50A

V5.17(ABMT.6)C0

XMG8825-B50A

V5.17(ABMT.6)C0

DX5401-B0

V5.17(ABYO.1)C0

EX3510-B0

V5.17(ABUP.4)C1

EX5401-B0

V5.17(ABYO.1)C0

EX5501-B0

V5.17(ABRY.2)C0

Fiber ONT

AX7501-B0

V5.17(ABPC.1)C0

EP240P

V5.40(ABVH.0)C0

PM7300-T0

V5.42(ACBC.1)C0

PMG5317-T20B

V5.40(ABKI.4)C0

PMG5617GA

V5.40(ABNA.2)C0

PMG5617-T20B2

V5.41(ACBB.1)C0

PMG5622GA

V5.40(ABNB.2)C0

PX7501-B0

V5.17(ABPC.1)C0

 *Please reach out to your local Zyxel support team for the file.

 

Got a question?

Please contact your local service rep or visit Zyxel’s forum for further information or assistance.

Acknowledgments

Thanks to Martin Petran from Accenture for reporting the issues to us.

Revision history

2022-04-12: Initial release

2022-04-21: Updated the patch firmware version of VMG1312-T20B

Jason