medium5.4
CVE-2022-43390
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute …
Impact
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Lte7480-M804 Firmware | before 1.00\(abra.6\)c0 |
| Zyxel | Lte7490-M904 Firmware | before 1.00\(abqy.5\)c0 |
| Zyxel | Nebula Nr5101 Firmware | before 1.15\(accg.3\)c0 |
| Zyxel | Nebula Nr7101 Firmware | before 1.15\(accc.3\)c0 |
| Zyxel | Nr5101 Firmware | before 1.00\(abvc.6\)c0 |
| Zyxel | Nr7101 Firmware | before 1.00\(abuv.7\)c0 |
| Zyxel | Nr7102 Firmware | before 1.00\(abyd.2\)c0 |
| Zyxel | Dx3301-T0 Firmware | All versions |
| Zyxel | Dx4510-B1 Firmware | All versions |
| Zyxel | Dx5401-B0 Firmware | All versions |
| Zyxel | Emg3525-T50b Firmware | All versions |
| Zyxel | Emg5523-T50b Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders