Lucene search

ZyxelCVE-2022-38546

HistoryDec 21, 2022 - 2:15 a.m.

CVE-2022-38546

2022-12-2102:15:11

CWE-284

Zyxel

web.nvd.nist.gov

cve

zyxel nbg7510

dns

misconfiguration

vulnerability

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

58.5%

JSON

A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode.

Affected configurations

Nvd

Node

zyxelnbg7510Match-

AND

zyxelnbg7510_firmwareRange≤1.00\(abzy.2\)c0

VendorProductVersionCPE
zyxelnbg7510-cpe:2.3:h:zyxel:nbg7510:-:*:*:*:*:*:*:*
zyxelnbg7510_firmware*cpe:2.3:o:zyxel:nbg7510_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zyxel	nbg7510	-	cpe:2.3:h:zyxel:nbg7510:-:::::::*
zyxel	nbg7510_firmware	*	cpe:2.3:o:zyxel:nbg7510_firmware::::::::

CNA Affected

[
  {
    "vendor": "Zyxel",
    "product": "NBG7510 firmware",
    "versions": [
      {
        "version": "< V1.00(ABZY.3)C0",
        "status": "affected"
      }
    ]
  }
]

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dns-misconfiguration-in-nbg7510-home-router

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

58.5%

JSON

Related for CVE-2022-38546