Zyxel security advisory for security misconfiguration vulnerability of 4G LTE indoor routers
CVE: CVE-2023-22920
Summary
Zyxel has released patches for 4G LTE indoor routers LTE3202-M437 and LTE3316-M604 to address a security misconfiguration vulnerability. Users are advised to install the patch for optimal protection.
What is the vulnerability?
A security misconfiguration vulnerability exists in the previous firmware versions of LTE3202-M437 and LTE3316-M604 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet.
What versions are vulnerable—and what should you do?
After a thorough investigation, we’ve identified only two vulnerable products that are within the vulnerability support period and released firmware patches to address the issue, as shown in the table below.
| Affected model | Affected version | Patch availability |
|---|---|---|
| LTE3202-M437 | V1.00(ABWF.1)C0 | V1.00(ABWF.2)C0 |
| LTE3316-M604 | V2.00(ABMP.6)C0 | V2.00(ABMP.7)C0 |
If an on-market product is not listed above, it is NOT affected.
Got a question?
Please contact your local service rep or visit Zyxel’s Community for further information or assistance.
Acknowledgment
Thanks to Geoffroy Martin, Max Nolent, and ANSSI CERT-FR for reporting the issue to us.
Revision history
2023-2-22: Initial release