CVE-2022-40602 - A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator

Back Back to CVE browser

CRITICAL

A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator

Published Nov 22, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.06%

Description

A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authenticated administrator.

Affected products

Vendor Zyxel Product n/a Default
unknown
Affected
- < V1.00(ABLG.6)C0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Zyxel	n/a	unknown	Affected < V1.00(ABLG.6)C0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-798

Hard-coded Credentials

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43877		Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-configured-password-vulnerability-of-lte3301-m209		PatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Zyxel

Published Nov 22, 2022

Updated Apr 28, 2025

Reserved Sep 12, 2022

Link CVE-2022-40602

CISA Vulnrichment

Updated Apr 28, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-40602

Red Hat

No data

ENISA EUVD

Assigner Zyxel

Published Nov 22, 2022

Updated Apr 28, 2025

Link EUVD-2022-43877

GitHub

No data