CVE-2023-22922
📋 TL;DR
A buffer overflow vulnerability in Zyxel NBG-418N v2 router firmware allows remote unauthenticated attackers to cause denial-of-service conditions by sending specially crafted packets to Telnet services. This affects users with Telnet enabled on vulnerable firmware versions. The vulnerability requires Telnet to be enabled on the device.
💻 Affected Systems
- Zyxel NBG-418N v2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker could cause permanent device failure requiring physical reset or replacement, potentially disrupting all network connectivity.
Likely Case
Temporary denial-of-service causing router reboot and network disruption until device restarts.
If Mitigated
No impact if Telnet is disabled or device is patched.
🎯 Exploit Status
Exploitation requires Telnet service to be enabled and accessible. Crafted packets can trigger buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.00(AARP.14)C0
Vendor Advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nbg-418n-v2-home-router
Restart Required: Yes
Instructions:
1. Download firmware V1.00(AARP.14)C0 from Zyxel support site. 2. Log into router web interface. 3. Navigate to Maintenance > Firmware Upgrade. 4. Upload and install the new firmware. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable Telnet Service
allDisable Telnet service on the router to prevent exploitation.
Log into router web interface > Network > Telnet > Disable
Block Telnet Port
linuxBlock access to Telnet port (TCP 23) using firewall rules.
iptables -A INPUT -p tcp --dport 23 -j DROP
🧯 If You Can't Patch
- Disable Telnet service immediately if not required
- Implement network segmentation to isolate router from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Maintenance > System Info. If version is older than V1.00(AARP.14)C0 and Telnet is enabled, device is vulnerable.Check Version:
telnet [router_ip] 23 (if enabled) or check web interfaceVerify Fix Applied:
Verify firmware version shows V1.00(AARP.14)C0 or newer in Maintenance > System Info.📡 Detection & Monitoring
Log Indicators:
- Multiple failed Telnet connection attempts
- Router reboot logs without user action
- Telnet service crash logs
Network Indicators:
- Unusual traffic to TCP port 23
- Malformed Telnet packets
- Router becoming unresponsive
SIEM Query:
source="router_logs" AND ("telnet" OR "reboot") AND NOT user_action="true"