CVE-2022-43390: OS Command Injection

Q: What is the severity of CVE-2022-43390?

CVE-2022-43390 is categorized as a medium severity vulnerability due to its potential for command execution on affected devices.

Q: Who is affected by CVE-2022-43390?

CVE-2022-43390 affects multiple Zyxel devices, particularly those running firmware versions before V1.15(ACCC.3)C0.

Q: How do I fix CVE-2022-43390?

To fix CVE-2022-43390, upgrade the firmware of your Zyxel NR7101 device to version 1.15(ACCC.3)C0 or later.

Q: What type of vulnerability is CVE-2022-43390?

CVE-2022-43390 is a command injection vulnerability that can allow authenticated attackers to execute arbitrary OS commands.

Q: Is CVE-2022-43390 a remote vulnerability?

CVE-2022-43390 requires authentication, meaning an attacker must access the device locally or through other means to exploit it.

Published Jan 11, 2023

Updated

A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.

Affected Software

78 affected components

Zyxel Lte7480-m804 Firmware<1.00\(abra.6\)c0

Zyxel Lte7480-m804

Zyxel Lte7490-m904 Firmware<1.00\(abqy.5\)c0

Zyxel Lte7490-m904

Zyxel Nebula Nr5101 Firmware<1.15\(accg.3\)c0

Zyxel Nebula Nr5101

Zyxel Nebula Nr7101 Firmware<1.15\(accc.3\)c0

Zyxel Nebula Nr7101

Zyxel Nr5101 Firmware<1.00\(abvc.6\)c0

Zyxel Nr5101

Zyxel NR7101 firmware<1.00\(abuv.7\)c0

Zyxel NR7101

Zyxel Nr7102 Firmware<1.00\(abyd.2\)c0

Zyxel Nr7102

Zyxel DX3301-T0 firmware

Zyxel DX3301-T0

Zyxel Dx4510-b1 Firmware

Zyxel Dx4510-b1

Zyxel DX5401-B0 firmware

Zyxel DX5401-B0

Zyxel Emg3525-t50b Firmware

Zyxel Emg3525-t50b

Zyxel Emg5523-t50b Firmware

Zyxel Emg5523-t50b

Zyxel Emg5723-t50k Firmware

Zyxel Emg5723-t50k

Zyxel EX3301-T0 firmware

Zyxel EX3301-T0

Zyxel EX3510-B0 firmware<5.17\(abup.7\)c0

Zyxel EX3510-B0

Zyxel Ex5401-b0 Firmware

Zyxel Ex5401-b0

Zyxel Ex5501-b0 Firmware

Zyxel Ex5501-b0

Zyxel Ex5510-b0 Firmware<5.17\(abqx.7\)c0

Zyxel Ex5510-b0

Zyxel Ex5512-t0 Firmware

Zyxel Ex5512-t0

Zyxel Ex5600-t1 Firmware

Zyxel Ex5600-t1

Zyxel Ex5601-t0 Firmware

Zyxel Ex5601-t0

Zyxel EX5601-T1 firmware

Zyxel EX5601-T1

Zyxel Vmg3927-t50k Firmware

Zyxel Vmg3927-t50k

Zyxel VMG4005-B50A firmware

Zyxel VMG4005-B50A

Zyxel Vmg4005-b60a Firmware

Zyxel Vmg4005-b60a

Zyxel Vmg8623-t50b Firmware

Zyxel Vmg8623-t50b

Zyxel VMG8825-T50K firmware

Zyxel VMG8825-T50K

Zyxel AX7501-B0 firmware

Zyxel AX7501-B0

Zyxel Pm3100-t0 Firmware

Zyxel Pm3100-t0

Zyxel Pm5100-t0 Firmware

Zyxel Pm5100-t0

Zyxel Pm7300-t0 Firmware

Zyxel Pm7300-t0

Zyxel Pm7320-b0 Firmware

Zyxel Pm7320-b0

Zyxel Pmg5317-t20b Firmware

Zyxel Pmg5317-t20b

Zyxel Pmg5617-t20b2 Firmware

Zyxel Pmg5617-t20b2

Zyxel Pmg5617ga Firmware

Zyxel Pmg5617ga

Zyxel Pmg5622ga Firmware

Zyxel Pmg5622ga

Zyxel WX3100-T0 firmware

Zyxel WX3100-T0

Zyxel Wx3401-b0 Firmware

Zyxel Wx3401-b0

Zyxel Wx5600-t0 Firmware

Zyxel Wx5600-t0

Event History

Jan 11, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-43390?

CVE-2022-43390 is categorized as a medium severity vulnerability due to its potential for command execution on affected devices.

Who is affected by CVE-2022-43390?

CVE-2022-43390 affects multiple Zyxel devices, particularly those running firmware versions before V1.15(ACCC.3)C0.

How do I fix CVE-2022-43390?

To fix CVE-2022-43390, upgrade the firmware of your Zyxel NR7101 device to version 1.15(ACCC.3)C0 or later.

What type of vulnerability is CVE-2022-43390?

CVE-2022-43390 is a command injection vulnerability that can allow authenticated attackers to execute arbitrary OS commands.

Is CVE-2022-43390 a remote vulnerability?