CVE-2022-43390 - Vulnerability Details

A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01682.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Zyxel Subscribe	Ax7501-b0 Subscribe Ax7501-b0 Firmware Subscribe Dx3301-t0 Subscribe Dx3301-t0 Firmware Subscribe Dx4510-b1 Subscribe Dx4510-b1 Firmware Subscribe Dx5401-b0 Subscribe Dx5401-b0 Firmware Subscribe Emg3525-t50b Subscribe Emg3525-t50b Firmware Subscribe Emg5523-t50b Subscribe Emg5523-t50b Firmware Subscribe Emg5723-t50k Subscribe Emg5723-t50k Firmware Subscribe Ex3301-t0 Subscribe Ex3301-t0 Firmware Subscribe Ex3510-b0 Subscribe Ex3510-b0 Firmware Subscribe Ex5401-b0 Subscribe Ex5401-b0 Firmware Subscribe Ex5501-b0 Subscribe Ex5501-b0 Firmware Subscribe Ex5510-b0 Subscribe Ex5510-b0 Firmware Subscribe Ex5512-t0 Subscribe Ex5512-t0 Firmware Subscribe Ex5600-t1 Subscribe Ex5600-t1 Firmware Subscribe Ex5601-t0 Subscribe Ex5601-t0 Firmware Subscribe Ex5601-t1 Subscribe Ex5601-t1 Firmware Subscribe Lte7480-m804 Subscribe Lte7480-m804 Firmware Subscribe Lte7490-m904 Subscribe Lte7490-m904 Firmware Subscribe Nebula Nr5101 Subscribe Nebula Nr5101 Firmware Subscribe Nebula Nr7101 Subscribe Nebula Nr7101 Firmware Subscribe Nr5101 Subscribe Nr5101 Firmware Subscribe Nr7101 Subscribe Nr7101 Firmware Subscribe Nr7102 Subscribe Nr7102 Firmware Subscribe Pm3100-t0 Subscribe Pm3100-t0 Firmware Subscribe Pm5100-t0 Subscribe Pm5100-t0 Firmware Subscribe Pm7300-t0 Subscribe Pm7300-t0 Firmware Subscribe Pm7320-b0 Subscribe Pm7320-b0 Firmware Subscribe Pmg5317-t20b Subscribe Pmg5317-t20b Firmware Subscribe Pmg5617-t20b2 Subscribe Pmg5617-t20b2 Firmware Subscribe Pmg5617ga Subscribe Pmg5617ga Firmware Subscribe Pmg5622ga Subscribe Pmg5622ga Firmware Subscribe Vmg3927-t50k Subscribe Vmg3927-t50k Firmware Subscribe Vmg4005-b50a Subscribe Vmg4005-b50a Firmware Subscribe Vmg4005-b60a Subscribe Vmg4005-b60a Firmware Subscribe Vmg8623-t50b Subscribe Vmg8623-t50b Firmware Subscribe Vmg8825-t50k Subscribe Vmg8825-t50k Firmware Subscribe Wx3100-t0 Subscribe Wx3100-t0 Firmware Subscribe Wx3401-b0 Subscribe Wx3401-b0 Firmware Subscribe Wx5600-t0 Subscribe Wx5600-t0 Firmware Subscribe

Configuration 1 [-]

AND

cpe:2.3:o:zyxel:lte7480-m804_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:lte7480-m804:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:zyxel:lte7490-m904_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:lte7490-m904:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:zyxel:nebula_nr5101_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:nebula_nr5101:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:zyxel:nebula_nr7101_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:nebula_nr7101:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:zyxel:nr5101_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:nr5101:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:zyxel:nr7101_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:nr7101:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:zyxel:nr7102_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:nr7102:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:zyxel:dx3301-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:dx3301-t0:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:zyxel:dx4510-b1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:dx4510-b1:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:zyxel:dx5401-b0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:dx5401-b0:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:zyxel:emg3525-t50b_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:emg3525-t50b:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:zyxel:emg5523-t50b_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:emg5523-t50b:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:zyxel:emg5723-t50k_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:emg5723-t50k:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:zyxel:ex3301-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex3301-t0:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:zyxel:ex3510-b0_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex3510-b0:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:zyxel:ex5401-b0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex5401-b0:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND

cpe:2.3:o:zyxel:ex5501-b0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex5501-b0:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND

cpe:2.3:o:zyxel:ex5510-b0_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex5510-b0:-:*:*:*:*:*:*:*

Configuration 19 [-]

AND

cpe:2.3:o:zyxel:ex5512-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex5512-t0:-:*:*:*:*:*:*:*

Configuration 20 [-]

AND

cpe:2.3:o:zyxel:ex5600-t1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex5600-t1:-:*:*:*:*:*:*:*

Configuration 21 [-]

AND

cpe:2.3:o:zyxel:ex5601-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex5601-t0:-:*:*:*:*:*:*:*

Configuration 22 [-]

AND

cpe:2.3:o:zyxel:ex5601-t1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ex5601-t1:-:*:*:*:*:*:*:*

Configuration 23 [-]

AND

cpe:2.3:o:zyxel:vmg3927-t50k_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:vmg3927-t50k:-:*:*:*:*:*:*:*

Configuration 24 [-]

AND

cpe:2.3:o:zyxel:vmg4005-b50a_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:vmg4005-b50a:-:*:*:*:*:*:*:*

Configuration 25 [-]

AND

cpe:2.3:o:zyxel:vmg4005-b60a_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:vmg4005-b60a:-:*:*:*:*:*:*:*

Configuration 26 [-]

AND

cpe:2.3:o:zyxel:vmg8623-t50b_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:vmg8623-t50b:-:*:*:*:*:*:*:*

Configuration 27 [-]

AND

cpe:2.3:o:zyxel:vmg8825-t50k_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:vmg8825-t50k:-:*:*:*:*:*:*:*

Configuration 28 [-]

AND

cpe:2.3:o:zyxel:ax7501-b0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:ax7501-b0:-:*:*:*:*:*:*:*

Configuration 29 [-]

AND

cpe:2.3:o:zyxel:pm3100-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:pm3100-t0:-:*:*:*:*:*:*:*

Configuration 30 [-]

AND

cpe:2.3:o:zyxel:pm5100-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:pm5100-t0:-:*:*:*:*:*:*:*

Configuration 31 [-]

AND

cpe:2.3:o:zyxel:pm7300-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:pm7300-t0:-:*:*:*:*:*:*:*

Configuration 32 [-]

AND

cpe:2.3:o:zyxel:pm7320-b0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:pm7320-b0:-:*:*:*:*:*:*:*

Configuration 33 [-]

AND

cpe:2.3:o:zyxel:pmg5317-t20b_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:pmg5317-t20b:-:*:*:*:*:*:*:*

Configuration 34 [-]

AND

cpe:2.3:o:zyxel:pmg5617-t20b2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:pmg5617-t20b2:-:*:*:*:*:*:*:*

Configuration 35 [-]

AND

cpe:2.3:o:zyxel:pmg5617ga_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:pmg5617ga:-:*:*:*:*:*:*:*

Configuration 36 [-]

AND

cpe:2.3:o:zyxel:pmg5622ga_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:pmg5622ga:-:*:*:*:*:*:*:*

Configuration 37 [-]

AND

cpe:2.3:o:zyxel:wx3100-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:wx3100-t0:-:*:*:*:*:*:*:*

Configuration 38 [-]

AND

cpe:2.3:o:zyxel:wx3401-b0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:wx3401-b0:-:*:*:*:*:*:*:*

Configuration 39 [-]

AND

cpe:2.3:o:zyxel:wx5600-t0_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:wx5600-t0:-:*:*:*:*:*:*:*

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-46429	A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

History

Tue, 08 Apr 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Zyxel

Published: 2023-01-11T00:00:00.000Z

Updated: 2025-04-08T20:16:36.803Z

Reserved: 2022-10-18T00:00:00.000Z

Link: CVE-2022-43390

Vulnrichment

Updated: 2024-08-03T13:32:57.394Z

NVD

Status : Modified

Published: 2023-01-11T02:15:11.170

Modified: 2024-11-21T07:26:23.043

Link: CVE-2022-43390

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-78

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Projects

JSON object

JSON object

JSON object

JSON object

JSON object