Lucene search

ZyxelCVE-2023-22920

HistoryFeb 21, 2023 - 4:15 p.m.

CVE-2023-22920

2023-02-2116:15:11

CWE-284

Zyxel

web.nvd.nist.gov

cve-2023-22920

zyxel

lte3316-m604

firmware

security misconfiguration

remote access

telnet

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.004

Percentile

73.0%

JSON

A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet.

Affected configurations

Nvd

Node

zyxellte3202-m437_firmwareMatch1.00\(abwf.1\)c0

AND

zyxellte3202-m437Match-

Node

zyxellte3316-m604_firmwareMatch2.00\(abmp.6\)c0

AND

zyxellte3316-m604Match-

VendorProductVersionCPE
zyxellte3202-m437_firmware1.00(abwf.1)c0cpe:2.3:o:zyxel:lte3202-m437_firmware:1.00\(abwf.1\)c0:*:*:*:*:*:*:*
zyxellte3202-m437-cpe:2.3:h:zyxel:lte3202-m437:-:*:*:*:*:*:*:*
zyxellte3316-m604_firmware2.00(abmp.6)c0cpe:2.3:o:zyxel:lte3316-m604_firmware:2.00\(abmp.6\)c0:*:*:*:*:*:*:*
zyxellte3316-m604-cpe:2.3:h:zyxel:lte3316-m604:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zyxel	lte3202-m437_firmware	1.00(abwf.1)c0	cpe:2.3:o:zyxel:lte3202-m437_firmware:1.00\(abwf.1\)c0:::::::*
zyxel	lte3202-m437	-	cpe:2.3:h:zyxel:lte3202-m437:-:::::::*
zyxel	lte3316-m604_firmware	2.00(abmp.6)c0	cpe:2.3:o:zyxel:lte3316-m604_firmware:2.00\(abmp.6\)c0:::::::*
zyxel	lte3316-m604	-	cpe:2.3:h:zyxel:lte3316-m604:-:::::::*

CNA Affected

[
  {
    "vendor": "Zyxel",
    "product": "LTE3316-M604",
    "versions": [
      {
        "version": "V2.00(ABMP.6)C0",
        "status": "affected"
      }
    ]
  }
]

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-security-misconfiguration-vulnerability-of-4g-lte-indoor-routers

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.004

Percentile

73.0%

JSON

Related for CVE-2023-22920