CVE-2022-43393

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-11 · updated 2026-06-17
Weakness: CWE-754

Description

An improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70(ABMH.8)C0, which could allow an unauthenticated attacker to corrupt the contents of the memory and result in a denial-of-service (DoS) condition on a vulnerable device.

Affected products

Zyxel Gs1350-12Hp Firmware: before 4.70\(abpj.5\)c0 — fixed in 4.70\(abpj.5\)c0
Zyxel Gs1350-18Hp Firmware: before 4.70\(abpk.5\)c0 — fixed in 4.70\(abpk.5\)c0
Zyxel Gs1350-26Hp Firmware: before 4.70\(abpl.5\)c0 — fixed in 4.70\(abpl.5\)c0
Zyxel Gs1350-6Hp Firmware: before 4.70\(abpi.5\)c0 — fixed in 4.70\(abpi.5\)c0
Zyxel Gs1915-24E Firmware: before 4.70\(acdr.3\)c0 — fixed in 4.70\(acdr.3\)c0
Zyxel Gs1915-24Ep Firmware: before 4.70\(acds.3\)c0 — fixed in 4.70\(acds.3\)c0
Zyxel Gs1915-8 Firmware: before 4.70\(acap.3\)c0 — fixed in 4.70\(acap.3\)c0
Zyxel Gs1915-8Ep Firmware: before 4.70\(acaq.3\)c0 — fixed in 4.70\(acaq.3\)c0
Zyxel Gs1920-24Hpv2 Firmware: before 4.70\(abmi.8\)c0 — fixed in 4.70\(abmi.8\)c0
Zyxel GS1920-24v2 firmware: before 4.70\(abmh.8\)c0 — fixed in 4.70\(abmh.8\)c0
Zyxel Gs1920-48Hpv2 Firmware: before 4.70\(abmk.8\)c0 — fixed in 4.70\(abmk.8\)c0
Zyxel Gs1920-48V2 Firmware: before 4.70\(abmj.8\)c0 — fixed in 4.70\(abmj.8\)c0
Zyxel Gs2220-10 Firmware: before 4.70\(abro.6\)c0 — fixed in 4.70\(abro.6\)c0
Zyxel Gs2220-10Hp Firmware: before 4.70\(abrp.6\)c0 — fixed in 4.70\(abrp.6\)c0
Zyxel Gs2220-28 Firmware: before 4.70\(abrq.6\)c0 — fixed in 4.70\(abrq.6\)c0
Zyxel Gs2220-28Hp Firmware: before 4.70\(abrr.6\)c0 — fixed in 4.70\(abrr.6\)c0
Zyxel Gs2220-50 Firmware: before 4.70\(abrs.6\)c0 — fixed in 4.70\(abrs.6\)c0
Zyxel Gs2220-50Hp Firmware: before 4.70\(abrt.6\)c0 — fixed in 4.70\(abrt.6\)c0
Zyxel Mgs3500-24S Firmware: before 4.10\(abbr.2\)c0 — fixed in 4.10\(abbr.2\)c0
Zyxel Mgs3520-28 Firmware: before 4.10\(aatn.5\)c0; 4.10(abqm.1)c0 — fixed in 4.10\(aatn.5\)c0
Zyxel Mgs3520-28F Firmware: before 4.10\(aatm.4\)c0 — fixed in 4.10\(aatm.4\)c0
Zyxel Mgs3530-28 Firmware: before 4.10\(acem.2\)c0; 4.10(acfj.0)c0 — fixed in 4.10\(acem.2\)c0
Zyxel Xgs1930-28 Firmware: before 4.70\(abht.5\)c0 — fixed in 4.70\(abht.5\)c0
Zyxel Xgs1930-28Hp Firmware: before 4.70\(abhs.5\)c0 — fixed in 4.70\(abhs.5\)c0
Zyxel Xgs1930-52 Firmware: before 4.70\(abhu.5\)c0 — fixed in 4.70\(abhu.5\)c0
Zyxel Xgs1930-52Hp Firmware: before 4.70\(abhv.5\)c0 — fixed in 4.70\(abhv.5\)c0
Zyxel Xgs2210-28 Firmware: before 4.70\(aazj.2\)c0 — fixed in 4.70\(aazj.2\)c0
Zyxel Xgs2210-28Hp Firmware: before 4.70\(aazl.2\)c0 — fixed in 4.70\(aazl.2\)c0
Zyxel Xgs2210-52 Firmware: before 4.70\(aazk.2\)c0 — fixed in 4.70\(aazk.2\)c0
Zyxel Xgs2210-52Hp Firmware: before 4.70\(aazm.2\)c0 — fixed in 4.70\(aazm.2\)c0

How to fix

Upgrade to a fixed version: Zyxel Gs1350-12Hp Firmware 4.70\(abpj.5\)c0; Zyxel Gs1350-18Hp Firmware 4.70\(abpk.5\)c0; Zyxel Gs1350-26Hp Firmware 4.70\(abpl.5\)c0; Zyxel Gs1350-6Hp Firmware 4.70\(abpi.5\)c0; Zyxel Gs1915-24E Firmware 4.70\(acdr.3\)c0; Zyxel Gs1915-24Ep Firmware 4.70\(acds.3\)c0; Zyxel Gs1915-8 Firmware 4.70\(acap.3\)c0; Zyxel Gs1915-8Ep Firmware 4.70\(acaq.3\)c0; Zyxel Gs1920-24Hpv2 Firmware 4.70\(abmi.8\)c0; Zyxel GS1920-24v2 firmware 4.70\(abmh.8\)c0; Zyxel Gs1920-48Hpv2 Firmware 4.70\(abmk.8\)c0; Zyxel Gs1920-48V2 Firmware 4.70\(abmj.8\)c0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-43393 or the next vulnerability affects your stack