CVE-2022-43389: OS Command Injection Vulnerability in Zyxel CPE devices

Zyxel has released patches to address four security flaws affecting its CPE, fiber ONTs, and WiFi extenders to execute arbitrary operating system commands and cause DoS conditions.

The list of security vulnerabilities is as follows –

CVE-2022-43389 – A buffer overflow vulnerability in the library of the web server in some 5G NR/4G LTE CPE devices, which could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device. Note that the WAN access is disabled by default on most devices.

CVE-2022-43390 – A command injection vulnerability in the CGI program of some 5G NR/4G LTE CPE, DSL/Ethernet CPE, fiber ONT, and WiFi extender devices, which could allow a remote authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request. Note that the WAN access is disabled by default on most devices.

CVE-2022-43391 – A buffer overflow vulnerability in the parameter of the CGI program in some 5G NR/4G LTE CPE, DSL/Ethernet CPE, fiber ONT, and WiFi extender devices, which could allow a remote authenticated attacker to cause DoS conditions by sending a crafted HTTP request. Note that the WAN access is disabled by default on most devices.

CVE-2022-43392 – A buffer overflow vulnerability in the parameter of a web server in some 5G NR/4G LTE CPE, DSL/Ethernet CPE, fiber ONT, and WiFi extender devices, which could allow a remote authenticated attacker to cause DoS conditions by sending a crafted authorization request. Note that the WAN access is disabled by default on most devices.

The most severe of these is CVE-2022-43389 which was given a high CVSS3 Base Score of 8.6 by the company. The vulnerability can be exploited in low-complexity attacks without requiring privileges on the targeted devices or user interaction.

Zyxel has released security updates to patch the bugs and advises customers to upgrade CPE, fiber ONTs, and WiFi extenders to the latest available firmware.