Security readout for executives and security teams
Plain-English summary
This vulnerability affects the Shenzhen Zhiboton/ZBT WE1626 router firmware v21.06.18. The reported flaw could let an unauthenticated network attacker escalate privileges through the router’s Network Diagnosis function. For business leaders, the concern is device takeover risk, especially where routers are internet-exposed or used at branch, small-office, or remote sites.
Executive priority
Prioritize discovery and containment now for any exposed WE1626 routers. A critical unauthenticated network flaw on perimeter equipment can create broad compromise risk, and the source bundle does not provide a confirmed patch.
Technical view
CVE-2022-45551 is mapped to CWE-306 and has CVSS 3.1 score 9.8. The source bundle describes privilege escalation via WGET command behavior in the Network Diagnosis endpoint. The supplied affected metadata is incomplete, listing n/a for vendor and product, but the description names ZBT WE1626 router v21.06.18.
Likely exposure
Exposure is most likely where ZBT WE1626 routers running v21.06.18 are deployed and the management or diagnostic interface is reachable from untrusted networks. The provided CVE metadata does not include CPEs, deployment prevalence, or confirmed affected version ranges beyond the named firmware version.
Exploitation context
The supplied data does not state active exploitation, and the bundle marks KEV as false. The CVSS vector indicates network reachability, low complexity, no privileges, and no user interaction, so exposure should be treated as urgent even without confirmed exploitation.
Researcher notes
Key gaps are incomplete affected-product metadata, no CPEs, and no patch information in the supplied sources. Analysis should stay scoped to ZBT WE1626 firmware v21.06.18 unless vendor or CVE updates expand the affected set.
Mitigation direction
- Identify any ZBT WE1626 routers and record firmware versions.
- Restrict router administration and diagnostic interfaces to trusted management networks.
- Remove internet exposure for affected router management services.
- Check vendor or distributor guidance for fixed firmware or supported mitigations.
- Replace unsupported devices if no trustworthy fix is available.
- Monitor for unusual access to diagnostic or administration functions.
Validation and detection
- Inventory edge and branch routers for ZBT WE1626 devices.
- Confirm whether firmware version 21.06.18 is present.
- Verify management and diagnostic endpoints are not internet-accessible.
- Review router logs for unexpected diagnostic function use.
- Track vendor, CVE, and disclosure sources for patch updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-45551 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://blog.prodefense.io/zbt-we1626-wireless-router-cve-disclosures-b3534484d97dCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.