Skip to main content

Dx5401 B0 Firmware CVE-2023-28769

CRITICAL
Classic Buffer Overflow (CWE-120)
2023-04-27 security@zyxel.com.tw
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 27, 2023 - 09:15 nvd
CRITICAL 9.8

DescriptionNVD

The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device.

AnalysisAI

The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device. Affected products include: Zyxel Dx5401-B0 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.

CVE-2023-28770 HIGH POC
7.5 Apr 27

The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmwa

CVE-2022-26413 HIGH
8.0 Apr 11

A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a

CVE-2024-8748 HIGH
7.5 Dec 03

A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmwa

CVE-2024-5412 HIGH
7.5 Sep 03

A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 cou

CVE-2024-0816 MEDIUM
5.5 May 21

The buffer overflow vulnerability in the DX3300-T1 firmware version V5.50(ABVY.4)C0 could allow an authenticated local a

CVE-2022-26414 MEDIUM
5.5 Apr 11

A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware versi

CVE-2024-9197 MEDIUM
4.9 Dec 03

A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B f

CVE-2024-38269 MEDIUM
4.9 Sep 24

An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel

CVE-2024-38268 MEDIUM
4.9 Sep 24

An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG882

CVE-2024-38267 MEDIUM
4.9 Sep 24

An improper restriction of operations within the bounds of a memory buffer in the IPv6 address parser of the Zyxel VMG88

CVE-2024-38266 MEDIUM
4.9 Sep 24

An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG

CVE-2025-8693 HIGH
8.8 Nov 18

A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(A

Share

CVE-2023-28769 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy