CVE-2022-43390
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC...
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.
- Record
CVE-2022-43390- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2022-46429
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.
- Record
EUVD-2022-46429- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w46r-wg59-pm75
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC...
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.
- Record
GHSA-w46r-wg59-pm75- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.
- Record
CVE-2022-43390- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
- zyxel nr7101 firmware
- zyxel ax7501-b0 firmware
- zyxel dx3301-t0 firmware
- zyxel dx4510-b1 firmware
- zyxel dx5401-b0 firmware
- zyxel emg3525-t50b firmware
- zyxel emg5523-t50b firmware
- zyxel emg5723-t50k firmware
- zyxel ex3301-t0 firmware
- zyxel ex3510-b0 firmware
- zyxel ex5401-b0 firmware
- zyxel ex5501-b0 firmware
Show 27 moreShow less
- zyxel ex5510-b0 firmware
- zyxel ex5512-t0 firmware
- zyxel ex5600-t1 firmware
- zyxel ex5601-t0 firmware
- zyxel ex5601-t1 firmware
- zyxel lte7480-m804 firmware
- zyxel lte7490-m904 firmware
- zyxel nebula nr5101 firmware
- zyxel nebula nr7101 firmware
- zyxel nr5101 firmware
- zyxel nr7102 firmware
- zyxel pm3100-t0 firmware
- zyxel pm5100-t0 firmware
- zyxel pm7300-t0 firmware
- zyxel pm7320-b0 firmware
- zyxel pmg5317-t20b firmware
- zyxel pmg5617-t20b2 firmware
- zyxel pmg5617ga firmware
- zyxel pmg5622ga firmware
- zyxel vmg3927-t50k firmware
- zyxel vmg4005-b50a firmware
- zyxel vmg4005-b60a firmware
- zyxel vmg8623-t50b firmware
- zyxel vmg8825-t50k firmware
- zyxel wx3100-t0 firmware
- zyxel wx3401-b0 firmware
- zyxel wx5600-t0 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-43390 is a medium vulnerability (CVSS 5.4) in Zyxel Nr7101 Firmware, published January 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. No source names a fixed version.