#VU63561 Input validation error in ZyXEL Communications Corp. products - CVE-2022-26531
Published: May 24, 2022 / Updated: October 25, 2024
Vulnerability identifier: #VU63561
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2022-26531
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerable software:
USG series
USG FLEX series
VPN series
ZyWALL
ATP series
NSG series
NXC2500
NXC5500
NAP203
NAP303
NAP353
NWA50AX
NWA55AXE
NWA90AX
NWA1123-AC-HD
NWA1123-AC-PRO
NWA5123-AC-HD
WAX630S
NWA110AX
NWA210AX
NWA1123ACv3
NWA1302-AC
WAC500H
WAC500
WAC5302D-S
WAC5302D-Sv2
WAC6103D-I
WAC6303D-S
WAC6502D-E
WAC6502D-S
WAC6503D-S
WAC6553D-E
WAC6552D-S
WAX510D
WAX610D
WAX650S
USG series
USG FLEX series
VPN series
ZyWALL
ATP series
NSG series
NXC2500
NXC5500
NAP203
NAP303
NAP353
NWA50AX
NWA55AXE
NWA90AX
NWA1123-AC-HD
NWA1123-AC-PRO
NWA5123-AC-HD
WAX630S
NWA110AX
NWA210AX
NWA1123ACv3
NWA1302-AC
WAC500H
WAC500
WAC5302D-S
WAC5302D-Sv2
WAC6103D-I
WAC6303D-S
WAC6502D-E
WAC6502D-S
WAC6503D-S
WAC6553D-E
WAC6552D-S
WAX510D
WAX610D
WAX650S
Software vendor:
ZyXEL Communications Corp.
ZyXEL Communications Corp.
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in some CLI commands. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Remediation
Install updates from vendor's website.