Zyxel security advisory for command injection & buffer overflow of CPE, fiber ONTs, & WiFi extenders
Zyxel Employee
CVE: CVE-2022-43389, CVE-2022-43390, CVE-2022-43391, CVE-2022-43392
Summary
Zyxel is aware of multiple vulnerabilities reported by Positive Technologies and advises users to install the applicable firmware updates for optimal protection.
What are the vulnerabilities?
CVE-2022-43389
A buffer overflow vulnerability in the library of the web server in some 5G NR/4G LTE CPE devices, which could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device. Note that the WAN access is disabled by default on most devices.
CVE-2022-43390
A command injection vulnerability in the CGI program of some 5G NR/4G LTE CPE, DSL/Ethernet CPE, fiber ONT, and WiFi extender devices, which could allow a remote authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request. Note that the WAN access is disabled by default on most devices.
CVE-2022-43391
A buffer overflow vulnerability in the parameter of the CGI program in some 5G NR/4G LTE CPE, DSL/Ethernet CPE, fiber ONT, and WiFi extender devices, which could allow a remote authenticated attacker to cause DoS conditions by sending a crafted HTTP request. Note that the WAN access is disabled by default on most devices.
CVE-2022-43392
A buffer overflow vulnerability in the parameter of web server in some 5G NR/4G LTE CPE, DSL/Ethernet CPE, fiber ONT, and WiFi extender devices, which could allow a remote authenticated attacker to cause DoS conditions by sending a crafted authorization request. Note that the WAN access is disabled by default on most devices.
What versions are vulnerable—and what should you do?
After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period and released updates to address the vulnerabilities, as shown in the following tables.
Table 1. Models affected by CVE-2022-43389
Product | Affected model | Patch availability* |
5G NR/ 4G LTE CPE | LTE3202-M437 | V1.00(ABWF.1)C0 |
LTE3316-M604 | V2.00(ABMP.6)C0 | |
LTE7480-M804 | V1.00(ABRA.6)C0 | |
LTE7490-M904 | V1.00(ABQY.5)C0 | |
Nebula FWA510 | V1.15(ACGD.3)C0 | |
Nebula FWA710 | V1.15(ACGC.3)C0 | |
Nebula NR7101 | V1.15(ACCC.3)C0 | |
NR5103 | V4.19(ABYC.3)C0 | |
NR5103E | Hotfix available now | |
NR7101 | V1.00(ABUV.7)C0 | |
NR7102 | V1.00(ABYD.2)C0 | |
NR7103 | V1.00(ACCZ.1)C0 |
Table 2. Models affected by CVE-2022-43390
Product | Affected model | Patch availability* | |
5G NR/ 4G LTE CPE | LTE7480-M804 | V1.00(ABRA.6)C0 | |
LTE7490-M904 | V1.00(ABQY.5)C0 | ||
Nebula NR5101 | V1.15(ACCG.3)C0 | ||
Nebula NR7101 | V1.15(ACCC.3)C0 | ||
NR5101 | V1.00(ABVC.6)C0 | ||
NR7101 | V1.00(ABUV.7)C0 | ||
NR7102 | V1.00(ABYD.2)C0 | ||
DSL/Ethernet CPE | DX3301-T0 | Hotfix available now | |
DX5401-B0 | Hotfix available now | ||
EMG3525-T50B | Hotfix available now | ||
EMG5523-T50B | Hotfix available now | ||
EMG5723-T50K | Hotfix available now | ||
EX3301-T0 | Hotfix available now | ||
EX5401-B0 | Hotfix available now | ||
EX5501-B0 | Hotfix available now | ||
EX5600-T1 | Hotfix available now | ||
EX5601-T0 | Hotfix available now | ||
EX5601-T1 | Hotfix available now | ||
VMG3927-T50K | Hotfix available now | ||
VMG4005-B50A | Hotfix available now | ||
VMG4005-B60A | Hotfix available now | ||
VMG8623-T50B | Hotfix available now | ||
VMG8825-T50K | Hotfix available now | ||
Fiber ONT | AX7501-B0 | V5.17(ABPC.3)C0 | |
PM3100-T0 | V5.42(ACBF.1.1)C0 | ||
PM5100-T0 | V5.42(ACBF.1.1)C0 | ||
PM7300-T0 | V5.42(ABYY.1)C0 | ||
WiFi extender | WX3100-T0 | Hotfix available now | |
WX3401-B0 | V5.17(ABVE.2.1)C0 | ||
WX5600-T0 | Hotfix available now | ||
Table 3. Models affected by CVE-2022-43391
Product | Affected model | Patch availability* |
5G NR/ 4G LTE CPE | LTE3301-PLUS | Hotfix available now |
LTE5388-M804 | Hotfix available now | |
LTE5398-M904 | Hotfix available now | |
LTE7240-M403 | Hotfix available now | |
LTE7461-M602 | Hotfix available now | |
LTE7480-M804 | V1.00(ABRA.6)C0 | |
LTE7480-S905 | Hotfix available now | |
LTE7485-S905 | Hotfix available now | |
LTE7490-M904 | V1.00(ABQY.5)C0 | |
Nebula LTE3301-PLUS | V1.15(ACCA.3)C0 | |
Nebula LTE7461-M602 | V1.15(ACEV.3)C0 | |
Nebula NR5101 | V1.15(ACCG.3)C0 | |
Nebula NR7101 | V1.15(ACCC.3)C0 | |
NR5101 | V1.00(ABVC.6)C0 | |
NR7101 | V1.00(ABUV.7)C0 | |
NR7102 | V1.00(ABYD.2)C0 | |
DSL/Ethernet CPE | DX3301-T0 | Hotfix available now |
DX5401-B0 | Hotfix available now | |
EMG3525-T50B | Hotfix available now | |
EMG5523-T50B | Hotfix available now | |
EMG5723-T50K | Hotfix available now | |
EX3301-T0 | Hotfix available now | |
EX5401-B0 | Hotfix available now | |
EX5501-B0 | Hotfix available now | |
EX5600-T1 | Hotfix available now | |
EX5601-T0 | Hotfix available now | |
EX5601-T1 | Hotfix available now | |
VMG3927-T50K | Hotfix available now | |
VMG4005-B50A | Hotfix available now | |
VMG4005-B60A | Hotfix available now | |
VMG8623-T50B | Hotfix available now | |
VMG8825-T50K | Hotfix available now | |
Fiber ONT | AX7501-B0 | V5.17(ABPC.3)C0 |
PM3100-T0 | V5.42(ACBF.1.1)C0 | |
PM5100-T0 | V5.42(ACBF.1.1)C0 | |
PM7300-T0 | V5.42(ABYY.1)C0 | |
WiFi extender | WX3100-T0 | Hotfix available now |
WX3401-B0 | V5.17(ABVE.2.1)C0 | |
WX5600-T0 | Hotfix available now |
Table 4. Models affected by CVE-2022-43392
Product | Affected model | Patch availability* |
5G NR/ 4G LTE CPE | LTE3301-PLUS | Hotfix available now |
LTE5388-M804 | Hotfix available now | |
LTE5398-M904 | Hotfix available now | |
LTE7240-M403 | Hotfix available now | |
LTE7461-M602 | Hotfix available now | |
LTE7480-M804 | V1.00(ABRA.6)C0 | |
LTE7480-S905 | Hotfix available now | |
LTE7485-S905 | Hotfix available now | |
LTE7490-M904 | V1.00(ABQY.5)C0 | |
Nebula LTE3301-PLUS | V1.15(ACCA.3)C0 | |
Nebula LTE7461-M602 | V1.15(ACEV.3)C0 | |
Nebula NR5101 | V1.15(ACCG.3)C0 | |
Nebula NR7101 | V1.15(ACCC.3)C0 | |
NR5101 | V1.00(ABVC.6)C0 | |
NR7101 | V1.00(ABUV.7)C0 | |
NR7102 | V1.00(ABYD.2)C0 | |
DSL/Ethernet CPE | DX3301-T0 | Hotfix available now |
DX5401-B0 | Hotfix available now | |
EMG3525-T50B | Hotfix available now | |
EMG5523-T50B | Hotfix available now | |
EMG5723-T50K | Hotfix available now | |
EX3301-T0 | Hotfix available now | |
EX5401-B0 | Hotfix available now | |
EX5501-B0 | Hotfix available now | |
EX5600-T1 | Hotfix available now | |
EX5601-T0 | Hotfix available now | |
EX5601-T1 | Hotfix available now | |
VMG3927-T50K | Hotfix available now | |
VMG4005-B50A | Hotfix available now | |
VMG4005-B60A | Hotfix available now | |
VMG8623-T50B | Hotfix available now | |
VMG8825-T50K | Hotfix available now | |
Fiber ONT | AX7501-B0 | V5.17(ABPC.3)C0 |
PM3100-T0 | V5.42(ACBF.1.1)C0 | |
PM5100-T0 | V5.42(ACBF.1.1)C0 | |
PM7300-T0 | V5.42(ABYY.1)C0 | |
WiFi extender | WX3100-T0 | Hotfix available now |
WX3401-B0 | V5.17(ABVE.2.1)C0 | |
WX5600-T0 | Hotfix available now |
*For the patch firmware without a download link, please reach out to your local Zyxel support team for the file.
Please note that the table does NOT include customized models for internet service providers (ISPs).
For ISPs, please contact your Zyxel sales or service representatives for further details.
For end-users who received your Zyxel device from an ISP, we recommend you reach out to the ISP’s support team directly, as the device may have custom-built settings.
For end-users who purchased the Zyxel devices on your own, please contact your local Zyxel support team for the new firmware file to ensure optimal protection, or visit our forum for further assistance.
Got a question?
Please contact your local service rep or visit Zyxel’s Community for further information or assistance.
Acknowledgement
Thanks to Nikita Abramov from Positive Technologies for reporting the issues to us.
Revision history
2023-1-11: Initial release
Comments
-
Hotfix available now
Standard firmware V5.70(ACDZ.1)C0 in Feb. 2023 link download please?1 -
Someone could please post link for V5.70(ACDZ.1)C0?
Thanks. KR.0 -
Hi there
You may need to check it with your ISP for FW upgrade.
0 -
Too bad, if the device came from WindTre, I guess the firmware is also a customized version (not the standard version in this post) and can only be updated/managed by WindTre.
It seems still need to check with WindTre.
0 -
NR5103E
Hotfix available now
Standard firmware V5.70(ACDZ.1)C0 in Feb. 2023 link download please?0 -
5.70(ACDZ.1)C0 isn't used on NR5103E, please help to provide serial number of your device and then we will check which one is correct for you.
0 -
NR5103EHotfix available now
Standard firmware V1.00(ACDJ.0)C0 in Apr. 20230 -
Dear Zyxel,
Please tell me if I am protected or at risk and which should be my first FW update if so.
Model NR5103
Serial S210Z35005660
Software: 5GEE_Router_V01.12 or V4.19(ACAF.2)b25
Thanks!
0 -
V4.19(ACAF.2)b25 Where did you download it?
0
Ally Member
Master Member
Guru Member
Categories
- All Categories
- 415 Beta Program
- 2.4K Nebula
- 146 Nebula Ideas
- 96 Nebula Status and Incidents
- 5.7K Security
- 262 USG FLEX H Series
- 271 Security Ideas
- 1.4K Switch
- 74 Switch Ideas
- 1.1K Wireless
- 40 Wireless Ideas
- 6.4K Consumer Product
- 249 Service & License
- 387 News and Release
- 84 Security Advisories
- 29 Education Center
- 10 [Campaign] Zyxel Network Detective
- 3.5K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 85 About Community
- 73 Security Highlight