CVE-2022-43390
Medium
Description
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Zyxel Nr7101 Firmware
PublishedJan 11, 2023
First seenJan 11, 2023
Weakness typeCWE-78OS command injection
How to fix
Update
- zyxel nr7101_firmware1.00\(abuv.7\)c0 or later
- zyxel lte7480-m804_firmware1.00\(abra.6\)c0 or later
- zyxel lte7490-m904_firmware1.00\(abqy.5\)c0 or later
- zyxel nebula_nr5101_firmware1.15\(accg.3\)c0 or later
- zyxel nebula_nr7101_firmware1.15\(accc.3\)c0 or later
- zyxel nr5101_firmware1.00\(abvc.6\)c0 or later
- zyxel nr7102_firmware1.00\(abyd.2\)c0 or later
- zyxel ex3510-b0_firmware5.17\(abup.7\)c0 or later
- zyxel ex5510-b0_firmware5.17\(abqx.7\)c0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zyxel nr7101_firmware | v < 1.00\(abuv.7\)c0 | 1.00\(abuv.7\)c0 |
| zyxel lte7480-m804_firmware | v < 1.00\(abra.6\)c0 | 1.00\(abra.6\)c0 |
| zyxel lte7490-m904_firmware | v < 1.00\(abqy.5\)c0 | 1.00\(abqy.5\)c0 |
| zyxel nebula_nr5101_firmware | v < 1.15\(accg.3\)c0 | 1.15\(accg.3\)c0 |
| zyxel nebula_nr7101_firmware | v < 1.15\(accc.3\)c0 | 1.15\(accc.3\)c0 |
| zyxel nr5101_firmware | v < 1.00\(abvc.6\)c0 | 1.00\(abvc.6\)c0 |
| zyxel nr7102_firmware | v < 1.00\(abyd.2\)c0 | 1.00\(abyd.2\)c0 |
| zyxel dx3301-t0_firmware | No range specified | — |
| zyxel dx4510-b1_firmware | No range specified | — |
| zyxel dx5401-b0_firmware | No range specified | — |
| zyxel emg3525-t50b_firmware | No range specified | — |
| zyxel emg5523-t50b_firmware | No range specified | — |
| zyxel emg5723-t50k_firmware | No range specified | — |
| zyxel ex3301-t0_firmware | No range specified | — |
| zyxel ex3510-b0_firmware | v < 5.17\(abup.7\)c0 | 5.17\(abup.7\)c0 |
| zyxel ex5401-b0_firmware | No range specified | — |
| zyxel ex5501-b0_firmware | No range specified | — |
| zyxel ex5510-b0_firmware | v < 5.17\(abqx.7\)c0 | 5.17\(abqx.7\)c0 |
| zyxel ex5512-t0_firmware | No range specified | — |
| zyxel ex5600-t1_firmware | No range specified | — |
| zyxel ex5601-t0_firmware | No range specified | — |
| zyxel ex5601-t1_firmware | No range specified | — |
| zyxel vmg3927-t50k_firmware | No range specified | — |
| zyxel vmg4005-b50a_firmware | No range specified | — |
| zyxel vmg4005-b60a_firmware | No range specified | — |
| zyxel vmg8623-t50b_firmware | No range specified | — |
| zyxel vmg8825-t50k_firmware | No range specified | — |
| zyxel ax7501-b0_firmware | No range specified | — |
| zyxel pm3100-t0_firmware | No range specified | — |
| zyxel pm5100-t0_firmware | No range specified | — |
| zyxel pm7300-t0_firmware | No range specified | — |
| zyxel pm7320-b0_firmware | No range specified | — |
| zyxel pmg5317-t20b_firmware | No range specified | — |
| zyxel pmg5617-t20b2_firmware | No range specified | — |
| zyxel pmg5617ga_firmware | No range specified | — |
| zyxel pmg5622ga_firmware | No range specified | — |
| zyxel wx3100-t0_firmware | No range specified | — |
| zyxel wx3401-b0_firmware | No range specified | — |
| zyxel wx5600-t0_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.