CVE-2022-43393: Zyxel security advisory for DoS vulnerability of switches | Zyxel Networks

CVE: CVE-2022-43393

Summary

Zyxel has released patches for some switches affected by a denial-of-service (DoS) vulnerability. Users are advised to install them for optimal protection.

What is the vulnerability?

An improper check for unusual or exceptional conditions in the HTTP request processing function of some Zyxel switch versions could allow an attacker to corrupt the contents of the memory and result in a DoS condition on an affected device.

What versions are vulnerable—and what should you do?

After a thorough investigation, we’ve identified the vulnerable products that are within their vulnerability support period and released patches to address the vulnerability, as shown in the table below.

Since switches are mostly deployed in a local area network (LAN) environment, most potential DoS attacks can be reduced by firewalls or security gateways. Furthermore, for optimal protection, we suggest that users set more stringent management rules for remote access to their switches, such as by restricting HTTP or HTTPS requests to remotely access the device management interface or by limiting remote access by specific IP addresses.

Affected model

Affected version

Patch availability

GS1350-6HP

V4.70(ABPI.4)C0

V4.70(ABPI.5)C0

GS1350-12HP

V4.70(ABPJ.4)C0

V4.70(ABPJ.5)C0

GS1350-18HP

V4.70(ABPK.4)C0

V4.70(ABPK.5)C0

GS1350-26HP

V4.70(ABPL.4)C0

V4.70(ABPL.5)C0

GS1915-8

V4.70(ACAP.2)C0

V4.70(ACAP.3)C0

GS1915-8EP

V4.70(ACAQ.2)C0

V4.70(ACAQ.3)C0

GS1915-24E

V4.70(ACDR.2)C0

V4.70(ACDR.3)C0

GS1915-24EP

V4.70(ACDS.2)C0

V4.70(ACDS.3)C0

GS1920-24v2

V4.70(ABMH.7)C0

V4.70(ABMH.8)C0

GS1920-48v2

V4.70(ABMJ.7)C0

V4.70(ABMJ.8)C0

GS1920-24HPv2

V4.70(ABMI.7)C0

V4.70(ABMI.8)C0

GS1920-48HPv2

V4.70(ABMK.7)C0

V4.70(ABMK.8)C0

GS2220-10

V4.70(ABRO.5)C0

V4.70(ABRO.6)C0

GS2220-28

V4.70(ABRQ.5)C0

V4.70(ABRQ.6)C0

GS2220-50

V4.70(ABRS.5)C0

V4.70(ABRS.6)C0

GS2220-10HP

V4.70(ABRP.5)C0

V4.70(ABRP.6)C0

GS2220-28HP

V4.70(ABRR.5)C0

V4.70(ABRR.6)C0

GS2220-50HP

V4.70(ABRT.5)C0

V4.70(ABRT.6)C0

XGS1930-28

V4.70(ABHT.3)C0

V4.70(ABHT.5)C0

XGS1930-28HP

V4.70(ABHS.3)C0

V4.70(ABHS.5)C0

XGS1930-52

V4.70(ABHU.3)C0

V4.70(ABHU.5)C0

XGS1930-52HP

V4.70(ABHV.3)C0

V4.70(ABHV.5)C0

XS1930-10

V4.70(ABQE.5)C0

V4.80(ABQE.0)C0

XS1930-12HP

V4.70(ABQF.5)C0

V4.80(ABQF.0)C0

XS1930-12F

V4.70(ABZV.5)C0

V4.80(ABZV.0)C0

XGS2210-28

V4.70(AAZJ.1)C0

V4.70(AAZJ.2)C0

XGS2210-52

V4.70(AAZK.1)C0

V4.70(AAZK.2)C0

XGS2210-28HP

V4.70(AAZL.1)C0

V4.70(AAZL.2)C0

XGS2210-52HP

V4.70(AAZM.1)C0

V4.70(AAZM.2)C0

XGS2220-30

V4.80(ABXN.0)C0

V4.80(ABXN.1)C0

XGS2220-30HP

V4.80(ABXO.0)C0

V4.80(ABXO.1)C0

XGS2220-30F

V4.80(ABYE.0)C0

V4.80(ABYE.1)C0

XGS2220-54

V4.80(ABXP.0)C0

V4.80(ABXP.1)C0

XGS2220-54HP

V4.80(ABXQ.0)C0

V4.80(ABXQ.1)C0

XGS2220-54FP

V4.80(ACCE.0)C0

V4.80(ACCE.1)C0

XGS4600-32

V4.70(ABBH.3)C0

V4.70(ABBH.4)C0

XGS4600-32F

V4.70(ABBI.3)C0

V4.70(ABBI.4)C0

XGS4600-52F

V4.70(ABIK.3)C0

V4.70(ABIK.4)C0

XMG1930-30

V4.70(ACAR.0)

V4.80(ACAR.0)

XMG1930-30HP

V4.70(ACAS.0)

V4.80(ACAS.0)

XS3800-28

V4.80(ABML.0)C0

V4.80(ABML.1)C0

MGS3500-24S

4.10(ABBR.1)C0

4.10(ABBR.2)C0*

MGS3520-28

4.10(AATN.4)C0

4.10(AATN.5)C0*

MGS3520-28

4.10(ABQM.1)C0

4.10(ABQM.2)C0*

MGS3520-28F

4.10(AATM.3)C0

4.10(AATM.4)C0*

MGS3530-28

4.10(ACEM.1)C0

4.10(ACEM.2)C0*

MGS3530-28

4.10(ACFJ.0)C0

4.10(ACFJ.1)C0*

*Please reach out to your local Zyxel support team for the file.

Got a question?

Please contact your local service rep or visit Zyxel’s Community for further information or assistance.

Acknowledgment

Thanks to Positive Technologies for reporting the issue to us.

Revision history

2023-1-11: Initial release.

Have a question?

We are always here to help!

Contact us