CVE-2022-40602 - OpenCVE

A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zyxel	Lte3301-m209 Lte3301-m209 Firmware

Configuration 1 [-]

AND

cpe:2.3:h:zyxel:lte3301-m209:-:*:*:*:*:*:*:*

cpe:2.3:o:zyxel:lte3301-m209_firmware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-configured-password-vulnerability-of-lte3301-m209

History

No history.

MITRE

Status: PUBLISHED

Assigner: Zyxel

Published: 2022-11-22T00:00:00

Updated: 2024-08-03T12:21:46.528Z

Reserved: 2022-09-12T00:00:00

Link: CVE-2022-40602

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-11-22T02:15:14.137

Modified: 2022-11-26T03:27:40.473

Link: CVE-2022-40602

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:lte3301-m209:-:*:*:*:*:*:*:*", "matchCriteriaId": "BDBC668E-C94D-4236-8007-E9433E2BB5AE", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:lte3301-m209_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF433884-9A96-4AE5-9E0E-B09CC1CA612F", "versionEndExcluding": "1.00\\(ablg.6\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator."}, {"lang": "es", "value": "Una falla en las versiones de firmware Zyxel LTE3301-M209 anteriores a V1.00(ABLG.6)C0 podr\u00eda permitir que un atacante remoto acceda al dispositivo usando una contrase\u00f1a preconfigurada incorrecta si la funci\u00f3n de administraci\u00f3n remota ha sido habilitada por un administrador autenticado."}], "id": "CVE-2022-40602", "lastModified": "2022-11-26T03:27:40.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@zyxel.com.tw", "type": "Secondary"}]}, "published": "2022-11-22T02:15:14.137", "references": [{"source": "security@zyxel.com.tw", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-configured-password-vulnerability-of-lte3301-m209"}], "sourceIdentifier": "security@zyxel.com.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@zyxel.com.tw", "type": "Secondary"}]}