What’s Vulnerable › Vulnerabilities

CVE-2022-43389

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-11 · updated 2026-06-17
• Weakness: CWE-120

Description

A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device.

Affected products

• Zyxel Ep240P Firmware: all versions
• Zyxel Lte3202-M437 Firmware: before 1.00\(abwf.1\)c0 — fixed in 1.00\(abwf.1\)c0
• Zyxel Lte3316-M604 Firmware: before 2.00\(abmp.6\)c0 — fixed in 2.00\(abmp.6\)c0
• Zyxel Lte7480-M804 Firmware: before 1.00\(abra.6\)c0 — fixed in 1.00\(abra.6\)c0
• Zyxel Lte7490-M904 Firmware: before 1.00\(abqy.5\)c0 — fixed in 1.00\(abqy.5\)c0
• Zyxel Nebula Fwa510 Firmware: before 1.15\(acgd.3\)c0 — fixed in 1.15\(acgd.3\)c0
• Zyxel Nebula Fwa710 Firmware: before 1.15\(acgc.3\)c0 — fixed in 1.15\(acgc.3\)c0
• Zyxel Nebula Nr7101 Firmware: before 1.15\(accc.3\)c0 — fixed in 1.15\(accc.3\)c0
• Zyxel Nr5103 Firmware: before 4.19\(abyc.3\)c0 — fixed in 4.19\(abyc.3\)c0
• Zyxel Nr5103E Firmware: all versions
• Zyxel NR7101 firmware: before 1.00\(abuv.7\)c0 — fixed in 1.00\(abuv.7\)c0
• Zyxel Nr7102 Firmware: before 1.00\(abyd.2\)c0 — fixed in 1.00\(abyd.2\)c0
• Zyxel Nr7103 Firmware: before 1.00\(accz.1\)c0 — fixed in 1.00\(accz.1\)c0
• Zyxel Pm7320-B0 Firmware: all versions
• Zyxel Pmg5317-T20B Firmware: all versions
• Zyxel Pmg5617Ga Firmware: all versions
• Zyxel Pmg5622Ga Firmware: all versions

How to fix

Upgrade to a fixed version: Zyxel Lte3202-M437 Firmware 1.00\(abwf.1\)c0; Zyxel Lte3316-M604 Firmware 2.00\(abmp.6\)c0; Zyxel Lte7480-M804 Firmware 1.00\(abra.6\)c0; Zyxel Lte7490-M904 Firmware 1.00\(abqy.5\)c0; Zyxel Nebula Fwa510 Firmware 1.15\(acgd.3\)c0; Zyxel Nebula Fwa710 Firmware 1.15\(acgc.3\)c0; Zyxel Nebula Nr7101 Firmware 1.15\(accc.3\)c0; Zyxel Nr5103 Firmware 4.19\(abyc.3\)c0; Zyxel NR7101 firmware 1.00\(abuv.7\)c0; Zyxel Nr7102 Firmware 1.00\(abyd.2\)c0; Zyxel Nr7103 Firmware 1.00\(accz.1\)c0. Check the vendor advisory for mitigations.

References

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders
• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders

Get alerted when CVE-2022-43389 or the next vulnerability affects your stack