CVE-2022-45440 Path traversal in AX7501-B0 firmware

Medium 4.4 Published 17 Jan 2023 Updated 17 Dec 2025

A local administrator can access the root file system via symbolic links on external storage in the Zyxel AX7501-B0 FTP server.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-45440?

CVE-2022-45440 is a medium-severity path traversal vulnerability in Zyxel AX7501-B0 firmware, published on 17 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system by creating a symbolic link on external storage media, such as a USB flash drive, and then logging into the FTP server on a vulnerable device.

Weakness: CWE-59

Which versions are affected by CVE-2022-45440?

It affects 1 product.

Products include Zyxel Ax7501-B0 Firmware.

How do I fix CVE-2022-45440?

No fix has been published for CVE-2022-45440 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-45440 being exploited?

There is no known exploitation of CVE-2022-45440 in the wild and no public exploit code.

Sources

Also known as GHSA-rpwq-xw4m-459x.