Command injection

2023-01-1102:15:00

PRIOn knowledge base

www.prio-n.com

command injection

zyxel nr7101

firmware vulnerability

http request crafted

os commands executed

authenticated attacker

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.2%

JSON

A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.

CPENameOperatorVersion
ex3510-b0_firmwareeq< 5.17abup.7c0
ex5510-b0_firmwareeq< 5.17abqx.7c0
lte7480-m804_firmwareeq< 1.0abra.6c0
lte7490-m904_firmwareeq< 1.0abqy.5c0
nebula_nr5101_firmwareeq< 1.15accg.3c0
nebula_nr7101_firmwareeq< 1.15accc.3c0
nr5101_firmwareeq< 1.0abvc.6c0
nr7101_firmwareeq< 1.0abuv.7c0
nr7102_firmwareeq< 1.0abyd.2c0

Name	Operator	Version
ex3510-b0_firmware	eq	< 5.17abup.7c0
ex5510-b0_firmware	eq	< 5.17abqx.7c0
lte7480-m804_firmware	eq	< 1.0abra.6c0
lte7490-m904_firmware	eq	< 1.0abqy.5c0
nebula_nr5101_firmware	eq	< 1.15accg.3c0
nebula_nr7101_firmware	eq	< 1.15accc.3c0
nr5101_firmware	eq	< 1.0abvc.6c0
nr7101_firmware	eq	< 1.0abuv.7c0
nr7102_firmware	eq	< 1.0abyd.2c0

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders