Paper/Archive/CVE-2022-38546

CVE-2022-38546

Zyxel NBG7510 firmware — A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attack…

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 51.5.515 × 2010.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode.

Affected

ProductAffectedFixed inSource

NBG7510 firmware< V1.00(ABZY.3)C0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zyxel (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refzyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dns-misconfiguration-in-nbg7510-home-router