Zyxel security advisory for buffer overflow vulnerability in 4G LTE and 5G NR outdoor routers

CVE: CVE-2023-27989

Zyxel has released patches for some 4G LTE and 5G NR outdoor routers affected by a buffer overflow vulnerability. Users are advised to install them for optimal protection.

What are the vulnerabilities?

A buffer overflow vulnerability in the CGI program of some Zyxel 4G LTE and 5G NR outdoor routers could allow a remote authenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.

What versions are vulnerable—and what should you do?

After a thorough investigation, we’ve identified the vulnerable products that are within their vulnerability support period and released patches to address the vulnerability, as shown in the table below.

Affected model Affected version Patch availability
LTE7480-M804 V1.00(ABRA.6)C0 and earlier V1.00(ABRA.7)C0
LTE7490-M904 V1.00(ABQY.5)C0 and earlier V1.00(ABQY.6)C0
NR7101 V1.00(ABUV.7)C0 and earlier V1.00(ABUV.8)C0
Nebula NR7101 V1.15(ACCC.3)C0 and earlier Hotfix available by July 12, 2023*
Standard patch V1.16(ACCC.0)C0 in Oct. 2023

*Please reach out to your local Zyxel support team for the file.

Got a question?

Please contact your local service rep or visit Zyxel’s Community for further information or assistance.


Thanks to Chengfeng Ye, Prism Research Group - cse hkust for reporting the issue to us.

Revision history

2023-6-6: Initial release
2023-7-4: Updated the patch availability of Nebula NR7101