Zyxel security advisory for multiple vulnerabilities in NBG-418N v2 home router
Ally Member
CVE: CVE-2023-22921, CVE-2023-22922, CVE-2023-22923, CVE-2023-22924
Summary
Zyxel has released a patch addressing multiple vulnerabilities in the NBG-418N v2 home router. Users are advised to install the patch for optimal protection.
What are the vulnerabilities?
CVE-2023-22921
A cross-site scripting (XSS) vulnerability could allow a remote authenticated attacker with administrator privileges to store malicious scripts using a web management interface parameter, resulting in denial-of-service (DoS) conditions on an affected device. Note that WAN access is disabled by default on the home router.
CVE-2023-22922
A buffer overflow vulnerability could allow a remote unauthenticated attacker to cause DoS conditions by sending crafted packets if Telnet is enabled on a vulnerable device. Note that WAN access is disabled by default on the home router.
CVE-2023-22923
A format string vulnerability in a binary could allow a remote authenticated attacker to cause DoS conditions on a vulnerable device. Note that WAN access is disabled by default on the home router.
CVE-2023-22924
A buffer overflow vulnerability could allow a remote authenticated attacker with administrator privileges to cause DoS conditions by executing crafted CLI commands on a vulnerable device. Note that WAN access is disabled by default on the home router.
What versions are vulnerable—and what should you do?
After a thorough investigation, we’ve identified only one vulnerable product that is within the vulnerability support period and released a firmware patch to address the issue, as shown in the table below.
Affected model | Affected version | Patch availability |
|---|---|---|
NBG-418N v2 | V1.00(AARP.13)C0 and earlier |
Got a question?
Please contact your local service rep or visit Zyxel’s Community for further information or assistance.
Acknowledgment
Thanks to Toni Koivunen from Fitsec Ltd. for reporting the issues to us.
Revision history
2023-5-2: Initial release.
Categories
- All Categories
- 397 Beta Program
- 2.1K Nebula
- 116 Nebula Ideas
- 78 Nebula Status and Incidents
- 5.1K Security
- 52 USG FLEX H Series
- 247 Security Ideas
- 1.3K Switch
- 70 Switch Ideas
- 907 WirelessLAN
- 34 WLAN Ideas
- 5.9K Consumer Product
- 211 Service & License
- 332 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 1.9K FAQ
- 880 Nebula FAQ
- 415 Security FAQ
- 221 Switch FAQ
- 195 WirelessLAN FAQ
- 46 Consumer Product FAQ
- 137 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 73 About Community
- 63 Security Highlight