CVE-2020-28899
Critical
Description
The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attackers (via crafted JSON action data to /cgi-bin/gui.cgi) to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi passphrase, send an SMS message, or modify the IP forwarding to access the internal network.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Zyxel Lte4506-m606 Firmware
PublishedMar 16, 2021
First seenMar 16, 2021
How to fix
Update
- zyxel lte4506-m606_firmwarev1.00\(abdo.6\)c0 or later
- zyxel lte7460-m608_firmwarev1.00\(abfr.5\)c0 or later
- zyxel wah7706_firmwarev1.00\(abbc.11\)c0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zyxel lte4506-m606_firmware | v < v1.00\(abdo.6\)c0 | v1.00\(abdo.6\)c0 |
| zyxel lte7460-m608_firmware | v < v1.00\(abfr.5\)c0 | v1.00\(abfr.5\)c0 |
| zyxel wah7706_firmware | v < v1.00\(abbc.11\)c0 | v1.00\(abbc.11\)c0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.