Zyxel security advisory for buffer overflow vulnerability in 4G LTE and 5G NR outdoor routers

Zyxel_May

CVE: CVE-2023-27989

Summary

Zyxel has released patches for some 4G LTE and 5G NR outdoor routers affected by a buffer overflow vulnerability. Users are advised to install them for optimal protection.

What are the vulnerabilities?

A buffer overflow vulnerability in the CGI program of some Zyxel 4G LTE and 5G NR outdoor routers could allow a remote authenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.

What versions are vulnerable—and what should you do?

After a thorough investigation, we’ve identified the vulnerable products that are within their vulnerability support period and released patches to address the vulnerability, as shown in the table below.

Affected model	Affected version	Patch availability
LTE7480-M804	V1.00(ABRA.6)C0 and earlier	V1.00(ABRA.7)C0
LTE7490-M904	V1.00(ABQY.5)C0 and earlier	V1.00(ABQY.6)C0
NR7101	V1.00(ABUV.7)C0 and earlier	V1.00(ABUV.8)C0
Nebula NR7101	V1.15(ACCC.3)C0 and earlier	Hotfix available by July 12, 2023* Standard patch V1.16(ACCC.0)C0 in Oct. 2023

*Please reach out to your local Zyxel support team for the file.

Got a question?

Please contact your local service rep or visit Zyxel’s Community for further information or assistance.

Acknowledgment

Thanks to Chengfeng Ye, Prism Research Group - cse hkust for reporting the issue to us.

Revision history

2023-6-6: Initial release.

2023-7-4: Updated the patch availability of Nebula NR7101