CVE-2023-22918 : Security Advisory and Response

This CVE record was published on April 24, 2023, by Zyxel. It involves a post-authentication information exposure vulnerability in the CGI program of various Zyxel firmware versions that could potentially allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.

Understanding CVE-2023-22918

This section will delve deeper into the details of CVE-2023-22918, including the vulnerability description, impact, affected systems, exploitation mechanism, and mitigation techniques.

What is CVE-2023-22918?

CVE-2023-22918 is an information exposure vulnerability found in Zyxel's ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions.

The Impact of CVE-2023-22918

This vulnerability has a CVSSv3.1 base score of 6.5, categorizing it as of medium severity. It poses a high risk to confidentiality as it allows a remote attacker to retrieve encrypted information of the device administrator, potentially leading to unauthorized access and data compromise.

Technical Details of CVE-2023-22918

In this section, we will explore the vulnerability description, affected systems and versions, as well as the exploitation mechanism associated with CVE-2023-22918.

Vulnerability Description

The vulnerability in the CGI program of the affected Zyxel firmware versions allows a remote authenticated attacker to access encrypted information of the device administrator post-authentication.

Affected Systems and Versions

The following Zyxel products are affected by CVE-2023-22918:

ATP series firmware versions 4.32 through 5.35
USG FLEX series firmware versions 4.50 through 5.35
USG FLEX 50(W) firmware versions 4.16 through 5.35
USG20(W)-VPN firmware versions 4.16 through 5.35
VPN series firmware versions 4.30 through 5.35
NWA110AX firmware version 6.50(ABTG.2) and earlier versions
WAC500 firmware version 6.50(ABVS.0) and earlier versions
WAX510D firmware version 6.50(ABTF.2) and earlier versions

Exploitation Mechanism

The vulnerability can be exploited by a remote authenticated attacker to retrieve encrypted information of the device administrator, potentially leading to unauthorized access.

Mitigation and Prevention

To address CVE-2023-22918, immediate steps should be taken along with the implementation of long-term security practices and regular patching and updates for the affected Zyxel firmware versions.

Immediate Steps to Take

Monitor network traffic for any suspicious activity
Apply vendor-released patches or workarounds
Change default credentials on affected devices

Long-Term Security Practices

Regular security assessments and vulnerability scans
Network segmentation and access control
Employee cybersecurity awareness training

Patching and Updates

Ensure that the Zyxel firmware versions mentioned in the affected products are regularly updated with the latest security patches and fixes to safeguard against vulnerabilities like CVE-2023-22918.