CVE-2023-22920 Misconfiguration in LTE3316-M604
A remote attacker can access the Zyxel LTE3316-M604 router via Telnet due to a factory default testing misconfiguration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22920?
CVE-2023-22920 is a critical vulnerability in Zyxel LTE3316-M604, published on 21 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet.
Weakness: CWE-284
Which versions are affected by CVE-2023-22920?
It affects 2 products.
Products include Zyxel Lte3202-M437 Firmware, Zyxel Lte3316-M604 Firmware.
How do I fix CVE-2023-22920?
No fix has been published for CVE-2023-22920 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-22920 being exploited?
There is no known exploitation of CVE-2023-22920 in the wild and no public exploit code.
Sources
Also known as GHSA-wpqc-593w-375g.