Main Vulnerability Database Vulnerabilities #VU67062

Format string error in ZyXEL Communications Corp. products - CVE-2022-34747

Published: September 7, 2022

Vulnerability identifier: #VU67062

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-34747

CWE-ID: CWE-134

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a format string error. A remote attacker can use a specially crafted UDP packet and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

NAS326
NAS540
NAS542

How to mitigate CVE-2022-34747

Install updates from vendor's website.

NAS326 - update to 5.21(AAZF.12)C0
NAS540 - update to 5.21(AATB.9)C0
NAS542 - update to 5.21(ABAG.9)C0

External References

https://www.zyxel.com/support/Zyxel-security-advisory-for-format-string-vulnerability-in-NAS.shtml

Related Security Bulletins