CVE-2023-22920 - OpenCVE

A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zyxel	Lte3202-m437 Lte3202-m437 Firmware Lte3316-m604 Lte3316-m604 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:zyxel:lte3202-m437_firmware:1.00\(abwf.1\)c0:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:lte3202-m437:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:zyxel:lte3316-m604_firmware:2.00\(abmp.6\)c0:*:*:*:*:*:*:*

cpe:2.3:h:zyxel:lte3316-m604:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-security-misconfiguration-vulnerability-of-4g-lte-indoor-routers

History

No history.

MITRE

Status: PUBLISHED

Assigner: Zyxel

Published: 2023-02-21T00:00:00

Updated: 2024-08-02T10:20:31.430Z

Reserved: 2023-01-10T00:00:00

Link: CVE-2023-22920

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-02-21T16:15:11.743

Modified: 2023-03-02T16:24:17.283

Link: CVE-2023-22920

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:lte3202-m437_firmware:1.00\\(abwf.1\\)c0:*:*:*:*:*:*:*", "matchCriteriaId": "ACA056DF-42B9-4530-9076-F5BAE33E4849", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:lte3202-m437:-:*:*:*:*:*:*:*", "matchCriteriaId": "9AFA5A91-B372-464B-9C8E-DFC6552E64EB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:lte3316-m604_firmware:2.00\\(abmp.6\\)c0:*:*:*:*:*:*:*", "matchCriteriaId": "9D8CE2DA-94BB-4263-B0FD-02AB3ECA8858", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:lte3316-m604:-:*:*:*:*:*:*:*", "matchCriteriaId": "557BE1D0-A562-4176-8E59-562E329DD602", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet."}], "id": "CVE-2023-22920", "lastModified": "2023-03-02T16:24:17.283", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@zyxel.com.tw", "type": "Secondary"}]}, "published": "2023-02-21T16:15:11.743", "references": [{"source": "security@zyxel.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-security-misconfiguration-vulnerability-of-4g-lte-indoor-routers"}], "sourceIdentifier": "security@zyxel.com.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "security@zyxel.com.tw", "type": "Secondary"}]}