CVE-2022-43389

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-43389", "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f", "assignerShortName": "Zyxel", "dateUpdated": "2025-04-09T13:52:22.737Z", "dateReserved": "2022-10-18T00:00:00.000Z", "datePublished": "2023-01-11T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f", "shortName": "Zyxel", "dateUpdated": "2023-01-11T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device."}], "affected": [{"vendor": "Zyxel", "product": "NR7101 firmware", "versions": [{"version": "< V1.15(ACCC.3)C0", "status": "affected"}]}], "references": [{"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "cweId": "CWE-120"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:32:58.640Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-09T13:52:13.858354Z", "id": "CVE-2022-43389", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T13:52:22.737Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:32:58.640Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-43389", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-09T13:52:13.858354Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T13:52:18.411Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Zyxel", "product": "NR7101 firmware", "versions": [{"status": "affected", "version": "< V1.15(ACCC.3)C0"}]}], "references": [{"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders"}], "descriptions": [{"lang": "en", "value": "A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f", "shortName": "Zyxel", "dateUpdated": "2023-01-11T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-43389", "state": "PUBLISHED", "dateUpdated": "2025-04-09T13:52:22.737Z", "dateReserved": "2022-10-18T00:00:00.000Z", "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f", "datePublished": "2023-01-11T00:00:00.000Z", "assignerShortName": "Zyxel"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "NR7101 firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "< V1.15(ACCC.3)C0"}]}], "source": "security@zyxel.com.tw"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:lte3202-m437_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEED7B93-7998-429A-9B16-49BAE465704F", "versionEndExcluding": "1.00\\(abwf.1\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:lte3202-m437:-:*:*:*:*:*:*:*", "matchCriteriaId": "9AFA5A91-B372-464B-9C8E-DFC6552E64EB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:lte3316-m604_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FBDC947-18E3-4A46-A7B3-9AB18032254E", "versionEndExcluding": "2.00\\(abmp.6\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:lte3316-m604:-:*:*:*:*:*:*:*", "matchCriteriaId": "557BE1D0-A562-4176-8E59-562E329DD602", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:lte7480-m804_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7DFDC741-78E6-42AA-B647-DEE9F04AA2DD", "versionEndExcluding": "1.00\\(abra.6\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:lte7480-m804:-:*:*:*:*:*:*:*", "matchCriteriaId": "E3480021-1538-48ED-BE89-BB0DF562C7DE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:lte7490-m904_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB812F29-2FAE-414C-9047-2471148B1E36", "versionEndExcluding": "1.00\\(abqy.5\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:lte7490-m904:-:*:*:*:*:*:*:*", "matchCriteriaId": "DC75F6DE-DCAF-47A0-B6BB-0E050C68AF25", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:nebula_fwa510_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7D1CEC6-D45B-4B6A-8A58-B099ADF57413", "versionEndExcluding": "1.15\\(acgd.3\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:nebula_fwa510:-:*:*:*:*:*:*:*", "matchCriteriaId": "80B7099C-DAA5-4902-A62B-B680C9450575", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:nebula_fwa710_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB7233D1-3202-471C-AEEA-F76E79F78346", "versionEndExcluding": "1.15\\(acgc.3\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:nebula_fwa710:-:*:*:*:*:*:*:*", "matchCriteriaId": "92221518-C7EA-46D7-8037-A580CEA01093", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:nebula_nr7101_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA537481-4311-4C5E-B577-76C8A789FDAC", "versionEndExcluding": "1.15\\(accc.3\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:nebula_nr7101:-:*:*:*:*:*:*:*", "matchCriteriaId": "52096C1F-F73C-413E-9D37-82EFA4703AEC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:nr5103_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B98AC59-4E5F-40AC-B6D6-DD669FAFEDCD", "versionEndExcluding": "4.19\\(abyc.3\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:nr5103:-:*:*:*:*:*:*:*", "matchCriteriaId": "C821C282-A1E3-4E31-A0C3-96936A4D90CB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:nr5103e_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "60ABD202-BEB3-4E0D-98CB-30AAA54E5B3B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:nr5103e:-:*:*:*:*:*:*:*", "matchCriteriaId": "97C7B929-E318-4E17-8AF9-160C8613132D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:nr7101_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "63A72A80-DA68-4353-8FEA-D372180F8401", "versionEndExcluding": "1.00\\(abuv.7\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:nr7101:-:*:*:*:*:*:*:*", "matchCriteriaId": "E4D27B24-9822-432C-8B8B-9546EE32DEC6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:nr7102_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C56958A5-2427-4A9A-BD40-3B548437CA36", "versionEndExcluding": "1.00\\(abyd.2\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:nr7102:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1A15757-DE6F-4A72-9CAD-BAC04BD340A0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:nr7103_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FD95007-25FD-4EF9-A461-19FBB4468B3D", "versionEndExcluding": "1.00\\(accz.1\\)c0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:nr7103:-:*:*:*:*:*:*:*", "matchCriteriaId": "77584A2D-D878-46E5-A632-10912DC3B794", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:ep240p_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "4CB5CB3D-4EBA-4C71-886A-5FF336E9F842", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:ep240p:-:*:*:*:*:*:*:*", "matchCriteriaId": "91367DDE-F430-42F7-B4F2-28AEF7FDCB12", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:pm7320-b0_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "E3B9C504-41A4-4756-BDB0-2EE317F801AE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:pm7320-b0:-:*:*:*:*:*:*:*", "matchCriteriaId": "E6A479CC-D543-49A1-8A37-7E9D4A0F0009", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:pmg5317-t20b_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "1141E1B7-B6B8-496B-A2CA-A9076D805741", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:pmg5317-t20b:-:*:*:*:*:*:*:*", "matchCriteriaId": "9F1334B5-FC76-412F-A7EF-02EEEE677460", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:pmg5617ga_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "366FB20C-6740-431A-A0CA-6EC3FDD3C505", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:pmg5617ga:-:*:*:*:*:*:*:*", "matchCriteriaId": "9C1B0834-3398-41B0-9A14-7D97768732B4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:pmg5622ga_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F61E8935-26CD-4664-A95C-1BCA77DBC4DF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:pmg5622ga:-:*:*:*:*:*:*:*", "matchCriteriaId": "840AF834-B7A6-4ACA-BAB9-996D87476D3D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de b\u00fafer en la librer\u00eda del servidor web en el firmware Zyxel NR7101 anterior a V1.15(ACCC.3)C0, que podr\u00eda permitir que un atacante no autenticado ejecute algunos comandos del sistema operativo o cause condiciones de denegaci\u00f3n de servicio (DoS) en un dispositivo vulnerable."}], "id": "CVE-2022-43389", "lastModified": "2026-06-17T05:06:24.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security@zyxel.com.tw", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-43389", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-09T13:52:13.858354Z", "version": "2.0.3"}}]}, "published": "2023-01-11T02:15:11.073", "references": [{"source": "security@zyxel.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders"}], "sourceIdentifier": "security@zyxel.com.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "security@zyxel.com.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}