9.8

CVE-2022-43389

A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zyxel ≫ Lte3202-m437 Firmware Version < 1.00\(abwf.1\)c0
   Zyxel ≫ Lte3202-m437 Version -
Zyxel ≫ Lte3316-m604 Firmware Version < 2.00\(abmp.6\)c0
   Zyxel ≫ Lte3316-m604 Version -
Zyxel ≫ Lte7480-m804 Firmware Version < 1.00\(abra.6\)c0
   Zyxel ≫ Lte7480-m804 Version -
Zyxel ≫ Lte7490-m904 Firmware Version < 1.00\(abqy.5\)c0
   Zyxel ≫ Lte7490-m904 Version -
Zyxel ≫ Nebula Fwa510 Firmware Version < 1.15\(acgd.3\)c0
   Zyxel ≫ Nebula Fwa510 Version -
Zyxel ≫ Nebula Fwa710 Firmware Version < 1.15\(acgc.3\)c0
   Zyxel ≫ Nebula Fwa710 Version -
Zyxel ≫ Nebula Nr7101 Firmware Version < 1.15\(accc.3\)c0
   Zyxel ≫ Nebula Nr7101 Version -
Zyxel ≫ Nr5103 Firmware Version < 4.19\(abyc.3\)c0
   Zyxel ≫ Nr5103 Version -
Zyxel ≫ Nr5103e Firmware Version -
   Zyxel ≫ Nr5103e Version -
Zyxel ≫ Nr7101 Firmware Version < 1.00\(abuv.7\)c0
   Zyxel ≫ Nr7101 Version -
Zyxel ≫ Nr7102 Firmware Version < 1.00\(abyd.2\)c0
   Zyxel ≫ Nr7102 Version -
Zyxel ≫ Nr7103 Firmware Version < 1.00\(accz.1\)c0
   Zyxel ≫ Nr7103 Version -
Zyxel ≫ Ep240p Firmware Version -
   Zyxel ≫ Ep240p Version -
Zyxel ≫ Pm7320-b0 Firmware Version -
   Zyxel ≫ Pm7320-b0 Version -
Zyxel ≫ Pmg5317-t20b Firmware Version -
   Zyxel ≫ Pmg5317-t20b Version -
Zyxel ≫ Pmg5617ga Firmware Version -
   Zyxel ≫ Pmg5617ga Version -
Zyxel ≫ Pmg5622ga Firmware Version -
   Zyxel ≫ Pmg5622ga Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.61% 0.445
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@zyxel.com.tw 8.6 3.9 4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders
Vendor Advisory