Zyxel security advisory for buffer overflow vulnerability in Realtek eCos SDK
Ally Member
CVE: CVE-2022-27255
Summary
Zyxel is aware of a buffer overflow vulnerability in some versions of Realtek’s Software Development Kit (SDK) and assures customers that Zyxel products are NOT affected.
What is the vulnerability?
A stack-based buffer overflow vulnerability was found in the SIP ALG module in some versions of Realtek’s eCos SDK. This could allow a remote unauthenticated attacker to trigger a buffer overflow and then cause a crash or achieve arbitrary code execution via a crafted SIP packet containing malicious SDP data.
What versions are vulnerable—and what should you do?
After a thorough investigation, we can confirm that Zyxel products are NOT affected, because they either do not use a vulnerable SDK version or do not adopt the vulnerable SIP ALG module.
Got a question?
Please contact your local service rep or visit Zyxel’s forum for further information or assistance.
Revision history
2022-08-18: Initial release.
Categories
- All Categories
- 300 Beta Program
- 1.9K Nebula
- 103 Nebula Ideas
- 72 Nebula Status and Incidents
- 4.8K Security
- 4 USG FLEX H Series
- 242 Security Ideas
- 1.1K Switch
- 54 Switch Ideas
- 807 WirelessLAN
- 29 WLAN Ideas
- 5.5K Consumer Product
- 178 Service & License
- 309 News and Release
- 69 Security Advisories
- 19 Education Center
- 5 [Campaign] Zyxel Network Detective
- 1.3K FAQ
- 555 Nebula FAQ
- 349 Security FAQ
- 118 Switch FAQ
- 147 WirelessLAN FAQ
- 33 Consumer Product FAQ
- 114 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 70 About Community
- 56 Security Highlight