Multiple vulnerabilities in Zyxel devices

Published: 2022-04-25

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-26413 CVE-2022-26414
CWE-ID	CWE-78 CWE-119
Exploitation vector	Local network
Public exploit	N/A
Vulnerable software Subscribe	EMG5723-T50K Hardware solutions / Routers for home users VMG1312-T20B Hardware solutions / Routers for home users VMG3625-T50B Hardware solutions / Routers for home users VMG3927-B50A Hardware solutions / Routers for home users VMG3927-B60A Hardware solutions / Routers for home users VMG3927-T50K Hardware solutions / Routers for home users VMG8623-T50B Hardware solutions / Routers for home users VMG8825-B50A Hardware solutions / Routers for home users VMG8825-B50B Hardware solutions / Routers for home users VMG8825-T50K Hardware solutions / Routers for home users VMG8825-B60A Hardware solutions / Routers for home users VMG8825-B60B Hardware solutions / Routers for home users XMG3927-B50A Hardware solutions / Routers for home users XMG8825-B50A Hardware solutions / Routers for home users DX5401-B0 Hardware solutions / Routers for home users EX3510-B0 Hardware solutions / Routers for home users EX5401-B0 Hardware solutions / Routers for home users EP240P Hardware solutions / Routers for home users PM7300-T0 Hardware solutions / Routers for home users PMG5617-T20B2 Hardware solutions / Routers for home users PX7501-B0 Hardware solutions / Routers for home users EX5501-B0 Hardware solutions / Firmware AX7501-B0 Hardware solutions / Firmware PMG5317-T20B Hardware solutions / Firmware PMG5617GA Hardware solutions / Firmware PMG5622GA Hardware solutions / Firmware
Vendor

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) OS Command Injection

EUVDB-ID: #VU62547

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26413

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the CGI program. A remote user on the local network can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

EMG5723-T50K: before V5.50(ABOM.7)C0

VMG1312-T20B: before V5.30(ABSB.5)C0

VMG3625-T50B: before V5.50(ABPM.6)C0

VMG3927-B50A: before V5.17(ABMT.6)C0

VMG3927-B60A: before V5.17(ABMT.6)C0

VMG3927-T50K: before V5.50(ABOM.7)C0

VMG8623-T50B: before V5.50(ABPM.6)C0

VMG8825-B50A: before V5.17(ABMT.6)C0

VMG8825-B50B: before V5.17(ABNY.7)C0

VMG8825-T50K: before V5.50(ABOM.7)C0

VMG8825-B60A: before V5.17(ABMT.6)C0

VMG8825-B60B: before V5.17(ABNY.7)C0

XMG3927-B50A: before V5.17(ABMT.6)C0

XMG8825-B50A: before V5.17(ABMT.6)C0

DX5401-B0: before V5.17(ABYO.1)C0

EX3510-B0: before V5.17(ABUP.4)C1

EX5401-B0: before V5.17(ABYO.1)C0

EX5501-B0: before V5.17(ABRY.2)C0

AX7501-B0: before V5.17(ABPC.1)C0

EP240P: before V5.40(ABVH.0)C0

PM7300-T0: before V5.42(ACBC.1)C0

PMG5317-T20B: before V5.40(ABKI.4)C0

PMG5617GA: before V5.40(ABNA.2)C0

PMG5617-T20B2: before V5.41(ACBB.1)C0

PMG5622GA: before V5.40(ABNB.2)C0

PX7501-B0: before V5.17(ABPC.1)C0

CPE2.3

cpe:2.3:h:zyxel_communications_corp:emg5723-t50k:*:*:*:*:*:*:*:*
Full software list in CPE2.3 format available after registration.

External links

http://www.zyxel.com/support/OS-command-injection-and-buffer-overflow-vulnerabilities-of-CPE-and-ONTs.shtml

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU62548