CVE-2023-22919
📋 TL;DR
This is a post-authentication command injection vulnerability in Zyxel NBG6604 home routers. An authenticated attacker can execute arbitrary OS commands by sending specially crafted HTTP requests. Only users with NBG6604 routers running the vulnerable firmware are affected.
💻 Affected Systems
- Zyxel NBG6604
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attacker to intercept all network traffic, install persistent malware, pivot to internal network devices, and potentially brick the device.
Likely Case
Attacker with valid credentials gains full control of router, enabling traffic monitoring, DNS hijacking, and credential theft from connected devices.
If Mitigated
With strong authentication and network segmentation, impact limited to router compromise without lateral movement to other systems.
🎯 Exploit Status
Exploitation requires valid admin credentials but command injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.01(ABIR.1)C0 or later
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware update section. 3. Download latest firmware from Zyxel support site. 4. Upload and apply firmware update. 5. Reboot router.
🔧 Temporary Workarounds
Change default credentials
allChange default admin password to strong, unique password
Disable remote admin access
allDisable WAN-side administrative access to router
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious HTTP requests to router admin interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status or Maintenance sectionCheck Version:
Check via web interface: http://router-ip/ or via SSH if enabledVerify Fix Applied:
Verify firmware version shows V1.01(ABIR.1)C0 or later after update📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to admin endpoints
- Multiple failed login attempts followed by successful login
Network Indicators:
- HTTP requests containing shell metacharacters like ;, |, &, $()
- Unusual outbound connections from router
SIEM Query:
source="router" AND (http_method="POST" AND uri="/cgi-bin/*" AND (content="*;*" OR content="*|*" OR content="*$(*"))🔗 References
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nbg6604-home-router
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerability-in-nbg6604-home-router
