Zyxel security advisory for DNS misconfiguration in NBG7510 home router
CVE: CVE-2022-38546
Summary
Zyxel has released a patch addressing a DNS misconfiguration in the NBG7510 home router. Users are advised to install the applicable update for optimal protection.
What is the vulnerability?
A DNS misconfiguration in Zyxel’s NBG7510 could allow an unauthenticated attacker to perform DNS-related attacks, such as DNS tunneling or DNS amplification attacks, by using the open DNS resolver when the device is switched to the AP mode.
What versions are vulnerable—and what should you do?
After a thorough investigation, we’ve identified only one vulnerable product that is within the vulnerability support period and released a firmware patch to address the issue, as shown in the table below.
Affected model |
Affected version |
Patch availability |
NBG7510 |
1.00(ABZY.2)C0 and earlier |
V1.00(ABZY.3)C0 |
Got a question?
Please contact your local service rep or visit Zyxel’s Community for further information or assistance.
Acknowledgment
Thanks to Alexander Traud for reporting the issue to us.
Revision history
2022-12-21: Initial release.
Categories
- All Categories
- 395 Beta Program
- 2.1K Nebula
- 116 Nebula Ideas
- 78 Nebula Status and Incidents
- 5.1K Security
- 51 USG FLEX H Series
- 247 Security Ideas
- 1.3K Switch
- 70 Switch Ideas
- 907 WirelessLAN
- 34 WLAN Ideas
- 5.9K Consumer Product
- 210 Service & License
- 332 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 1.9K FAQ
- 880 Nebula FAQ
- 415 Security FAQ
- 221 Switch FAQ
- 195 WirelessLAN FAQ
- 46 Consumer Product FAQ
- 137 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 72 About Community
- 63 Security Highlight