CVE-2022-26531
Description
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.
Affected products
10- Range: 4.32 through 5.21
- Zyxel/NAP203 firmwarev5Range: <= 6.25(ABFA.7)
- Zyxel/NSG series firmwarev5Range: 1.00 through 1.33 Patch 4
- Zyxel/NWA50AX firmwarev5Range: <= 6.25(ABYW.5)
- Zyxel/NXC2500 firmwarev5Range: <= 6.10(AAIG.3)
- Range: 4.50 through 5.21
- Range: 4.09 through 4.71
- Range: 4.30 through 5.21
- Zyxel/WAC500 firmwarev5Range: <= 6.30(ABVS.2)
- Zyxel/WAX510D firmwarev5Range: <= 6.30(ABTF.2)
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- seclists.org/fulldisclosure/2022/Jun/15mitremailing-list
- packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.htmlmitre
- packetstormsecurity.com/files/177036/Zyxel-zysh-Format-String-Proof-Of-Concept.htmlmitre
- www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtmlmitre
News mentions
0No linked articles in our index yet.