CVE-2022-45854 Denial of service in NWA110AX firmware

What is CVE-2022-45854?

CVE-2022-45854 is a medium-severity denial of service vulnerability in Zyxel NWA110AX firmware, published on 7 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary denial-of-service (DoS) by sending crafted VLAN frames if the MAC address of the vulnerable AP were intercepted by the attacker.

Weakness: CWE-754

Which versions are affected by CVE-2022-45854?

It affects 6 products.

Products include Zyxel Nwa110ax Firmware, Zyxel Nwa210ax Firmware, Zyxel Wax510d Firmware, Zyxel Wax610d Firmware, Zyxel Wax630s Firmware, Zyxel Wax650s Firmware.

How do I fix CVE-2022-45854?

No fix has been published for CVE-2022-45854 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-45854 being exploited?

There is no known exploitation of CVE-2022-45854 in the wild and no public exploit code.

Other vulnerabilities in Zyxel NWA110AX firmware

• CVE-2024-7261 Command injection in NWA1123ACv3 firmware Critical 9.8
• CVE-2024-12398 Privilege escalation in WBE530 firmware High 8.8
• CVE-2025-6265 Path traversal in NWA50AX PRO firmware High 7.2
• CVE-2024-1575 Privilege escalation in WBE660S firmware Medium 6.5
• CVE-2023-37925 Privilege escalation in ATP series firmware Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qm64-6g3m-3xmv.