TI-2022-22406 Aliases CVE-2022-45440 GHSA-rpwq-xw4m-459x

Link following in Zyxel AX7501-B0 firmware

LOW 20CWE-59Published 2023-01-17 · Updated 2025-12-17

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-59 and the CVSS impact.

Summary

A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system by creating a symbolic link on external storage media, such as a USB flash drive, and then logging into the FTP server on a vulnerable device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00249 16th percentileScored 2026-11-07

Fix Fixed AX7501-B0 firmware (Zyxel): V5.17(ABPC.3)C0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zyxel	AX7501-B0 firmware	before V5.17(ABPC.3)C0	V5.17(ABPC.3)C0	Patch available	CNA

AX7501-B0 firmware VendorZyxel Affected before V5.17(ABPC.3)C0 Fixed in V5.17(ABPC.3)C0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:zyxel:ax7501-b0_firmware::::::::	before 5.17\(abpc.3\)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:ax7501-b0:-:::::::*	not specified by NVD	Running on	Zyxel

cpe:2.3:o:zyxel:ax7501-b0_firmware:*:*:*:*:*:*:*:* Versions before 5.17\(abpc.3\)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:ax7501-b0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Remediation

Fix · CNA AX7501-B0 firmware (Zyxel) Fixed in V5.17(ABPC.3)C0

Timeline

2026-10-02 Threatist record created from CVE-2022-45440
2026-10-03 Alias added: GHSA-rpwq-xw4m-459x

References

Advisory 1

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-cleartext-storage-of-wifi-credentials-and-improper-symbolic-links-of-ftp-for-ax7501-b0-cpe

TI-2025-07956 OS command injection in Zyxel DX3300-T0 firmware CVSS 3.1HIGH 8.8
TI-2022-21188 OS command injection in Zyxel NR7101 firmware CVSS 3.1HIGH 8.8
TI-2024-05028 Buffer overflow in Zyxel VMG8825-T50K firmware CVSS 3.1HIGH 7.5
TI-2025-05994 Uncontrolled resource consumption in Zyxel DX3301-T0 firmware CVSS 3.1HIGH 7.5
TI-2024-08115 Buffer overflow in Zyxel VMG8825-T50K firmware CVSS 3.1HIGH 7.5
TI-2024-11143 OS command injection in Zyxel AX7501-B1 firmware CVSS 3.1HIGH 7.2

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences